PYSEC-2026-2853

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/openstack-cyborg/PYSEC-2026-2853.yaml
JSON Data
https://api.osv.dev/v1/vulns/PYSEC-2026-2853
Aliases
Published
2026-07-13T15:15:41.370919Z
Modified
2026-07-13T16:32:33.851457199Z
Severity
  • 7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L CVSS Calculator
Summary
OpenStack Cyborg uses rule:allow (check_str='@') as the default policy for multiple API endpoints
Details

OpenStack Cyborg before 16.0.1 uses rule:allow (check_str='@') as the default policy for multiple API endpoints. This unconditionally authorizes any request carrying a valid Keystone token regardless of roles, project membership, or scope. An authenticated user with zero role assignments can complete various actions such as reprogramming FPGA bitstreams on arbitrary compute nodes via agent RPC.

References

Affected packages

PyPI / openstack-cyborg

Package

Name
openstack-cyborg
View open source insights on deps.dev
Purl
pkg:pypi/openstack-cyborg

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
16.0.1

Affected versions

0.*
0.1.0
0.2.0
1.*
1.0.0.0b3
1.0.0.0rc1
1.0.0
2.*
2.0.0.0rc1
2.0.0
3.*
3.0.0.0rc1
3.0.0
3.0.1
4.*
4.0.0.0rc1
4.0.0
4.0.1
5.*
5.0.0.0rc1
5.0.0.0rc2
5.0.0
5.0.1
6.*
6.0.0.0rc1
6.0.0.0rc2
6.0.0
6.0.1
7.*
7.0.0.0rc1
7.0.0
7.0.1
8.*
8.0.0.0rc1
8.0.0
8.0.1
9.*
9.0.0.0rc1
9.0.0
10.*
10.0.0.0rc1
10.0.0
10.1.0
11.*
11.0.0.0rc1
11.0.0
12.*
12.0.0.0rc1
12.0.0
13.*
13.0.0.0rc1
13.0.0
14.*
14.0.0.0rc1
14.0.0
14.1.0
15.*
15.0.0.0rc1
15.0.0
15.0.1
16.*
16.0.0.0rc1
16.0.0.0rc2
16.0.0

Database specific

source 
"https://github.com/pypa/advisory-database/blob/main/vulns/openstack-cyborg/PYSEC-2026-2853.yaml"