CVE-2026-40213CWE-863

OpenStack Cyborg before 16.0.1 uses rule:allow (check_str='@') as the default policy for multiple API endpoints

High · published May 7, 2026

CVSS v3.1
7.4
EPSS
0%
Percentile
25.2
In the wild
Unconfirmed
What it is

OpenStack Cyborg before 16.0.1 uses rule:allow (check_str='@') as the default policy for multiple API endpoints. This unconditionally authorizes any request carrying a valid Keystone token regardless of roles, project membership, or scope. An authenticated user with zero role assignments can complete various actions such as reprogramming FPGA bitstreams on arbitrary compute nodes via agent RPC.

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00332 · 25.2th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-05-07T00:00Z
EPSS history
Timeline
  • 07 MAY 00:00Z
    OpenStack Cyborg before 16.0.1 uses rule:allow (check_str='@') as the default policy for multiple API endpoints
    cvelistv5