CVE-2026-71195

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-71195
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71195.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-71195
Downstream
Published
2026-10-21T05:31:56Z
Modified
2026-10-22T02:49:32Z
Severity
  • 9.9 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize operations against the caller's own project context, then load a foreign public share without re-authorizing against the share's actual owner. This affects the following operations: allow_access: grant data-plane read/write access to another tenant's share; deny_access: revoke the owner's existing access rules; update_access: escalate access level (e.g., ro to rw); create_share_backup: exfiltrate share data via a backup created under the attacker's project; soft_delete: move a foreign share to the recycle bin; restore: interfere with the owner's deletion workflow; export location metadata: create, update, and delete metadata on foreign export locations; access rule listing: disclose IPs, usernames, and CephFS keys. Any authenticated project member can exploit these operations on any public share. The share UUID is visible since the share is public.

Database specific 
{
    "cna_assigner":  "mitre",
    "cwe_ids":  [
        "CWE-863"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71195.json"
}
References

Affected packages

Git / opendev.org/openstack/manila

Affected ranges

Type
GIT
Repo
https://opendev.org/openstack/manila
Events
Introduced
f1eded1fbcaf309e1c9a4be3f8a14bd25daa3e46
Fixed
3296e23f0b67581019f7fe5ef0cebf9fa793058a
Introduced
1e090676e20fbbac3fa15e7b775a1b787fc40d17
Fixed
4c1fe63b68f29d0dc8bb2840b1bc455636e6cece
Introduced
bb1965a08a20c4ee63c6f9f2537cdc0a3a4451bd
Fixed
135192365e7ce0f9ddc07d29ad98161da022c9d6
Introduced
4d7180f148a6facf90a30fe2085b64fa21d0a6e9
Fixed
4fbc4b4f3688e916428a7d95d10009d414e705ab
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "1.0.0"
                },
                {
                    "fixed":  "20.0.3"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "introduced":  "21.0.0"
                },
                {
                    "fixed":  "21.0.3"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "introduced":  "22.0.0"
                },
                {
                    "fixed":  "22.0.2"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "introduced":  "23.0.0"
                },
                {
                    "fixed":  "23.0.1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        }
    ]
}

Affected versions

21.*
21.0.0
21.0.0.0rc2
21.0.1
21.0.2
22.*
22.0.0
22.0.0.0rc2
22.0.1
23.*
23.0.0
23.0.0.0rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71195.json"