Executive brief
OpenStack Cyborg, a service for managing hardware accelerators like FPGAs and GPUs, contains a flaw in its access control settings. This vulnerability allows any user with a valid login to perform administrative actions, regardless of their actual permissions or assigned roles. In practice, an unauthorized user could reprogram hardware components on corporate servers, view sensitive hardware configurations, or disrupt the scheduling of virtual machines.
Technical details
OpenStack Cyborg before 16.0.1 (and various backported versions) uses 'rule:allow' (check_str='@') as the default policy for multiple API endpoints, including device, deployable, and attribute management. This configuration causes oslo.policy to evaluate authorization as an unconditional 'True' for any request containing a valid Keystone token, ignoring roles, project membership, or scope. An authenticated attacker with no assigned roles can exploit this via the network to enumerate hardware topology, reprogram FPGA bitstreams via agent RPC, or manipulate hardware metadata. The vulnerability is addressed by replacing the permissive default with 'rule:admin_api' or 'rule:project_member_or_admin' as appropriate.
Affected products
- OpenStack Cyborg >=3.0.0 <14.0.1, >=15.0.0 <15.0.1, >=16.0.0 <16.0.1
Timeline
- 2026-03-04: disclosed: Bug reported to OpenStack by Sean Mooney
- 2026-05-07: advisory: OSSA-2026-011 published
- 2026-05-08: patched: GitHub advisory published for version 16.0.1