OpenStack Cinder 29.0.x: cross-project info disclosure in Messages API v3.3
CVE-2026-93856 Published on October 21, 2026
In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API. A non-admin user with the project-scoped 'member' or 'reader' role making the Block Storage API v3.3 "List messages" call finds the non-expired user messages for other projects included in the response, resulting in the leakage of UUIDs of resources owned by other projects, in addition to the user message about the other projects' resources (which, by design, are sanitized generic messages). All Cinder deployments are affected.
Vulnerability Analysis
CVE-2026-93856 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. Public availability of a proof of concept (POC) exploit exists for CVE-2026-93856. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a small impact on integrity and availability.
Weakness Type
Incorrect Resource Transfer Between Spheres
The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.
Products Associated with CVE-2026-93856
Want to know whenever a new CVE is published for OpenStack Cinder? stack.watch will email you.
Affected Versions
OpenStack Cinder:- Version 9.0.0 and below 26.3.1 is affected.
- Version 27.0.0 is affected.
- Version 28.0.0 is affected.
- Version 29.0.0 is affected.