Is CVE-2026-40214 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40214 being exploited in the wild.

How severe is CVE-2026-40214?

Medium severity, with a CVSS score of 6.3, published 7 May 2026.

Which products and versions are affected?

OpenStack Cyborg >=3.0.0, =15.0.0, =16.0.0, <16.0.1; openstack-cyborg (PyPI) < 16.0.1, ECOSYSTEM:introduced=0,fixed=16.0.1.

Is there a fix for CVE-2026-40214?

Yes. openstack-cyborg (PyPI): upgrade to 16.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-40214 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-40214?

Check whether you run OpenStack Cyborg or openstack-cyborg (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40214: OpenStack Cyborg improper ownership management in ARQ API

Q: Is there a fix for CVE-2026-40214?

Yes. openstack-cyborg (PyPI): upgrade to 16.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-40214 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-40214?

Check whether you run OpenStack Cyborg or openstack-cyborg (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40214 · Severity: medium · CVSS 6.3 · Published 2026-05-07

OpenStack Cyborg, a service for managing hardware accelerators like GPUs and FPGAs, contains a flaw where it fails to verify which project owns a specific resource. This allows any logged-in user to view, modify, or delete accelerator requests belonging to other customers or projects. In practice, an attacker could disrupt business operations by deleting resources required for virtual machines to start, leading to a cross-tenant denial of service.

Vendors: OpenStack, PyPI.

Quick answers

Is CVE-2026-40214 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40214 being exploited in the wild.
How severe is CVE-2026-40214?: Medium severity, with a CVSS score of 6.3, published 7 May 2026.
Which products and versions are affected?: OpenStack Cyborg >=3.0.0, <14.0.1; >=15.0.0, <15.0.1; >=16.0.0, <16.0.1; openstack-cyborg (PyPI) < 16.0.1, ECOSYSTEM:introduced=0,fixed=16.0.1.
Is there a fix for CVE-2026-40214?: Yes. openstack-cyborg (PyPI): upgrade to 16.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40214 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-40214?: Check whether you run OpenStack Cyborg or openstack-cyborg (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

openstack-cyborg (PyPI): upgrade to 16.0.1 or later
```
pip install "openstack-cyborg>=16.0.1"
```

Technical details

OpenStack Cyborg fails to enforce project-based access control for Accelerator Request (ARQ) resources. The vulnerability stems from three primary failures: the 'project_id' column in the database is never populated (remaining NULL), database queries lack project-level filtering, and the 'authorize_wsgi' decorator performs self-referential policy checks that compare a caller's project ID against itself rather than the target resource. An authenticated non-admin attacker can exploit this over the network to list all ARQs (disclosing instance UUIDs and hostnames), delete ARQs (preventing VM restarts), or manipulate bindings across different tenants. The issue is resolved in versions 14.0.1, 15.0.1, and 16.0.1.

Affected products

OpenStack Cyborg >=3.0.0, <14.0.1; >=15.0.0, <15.0.1; >=16.0.0, <16.0.1

Identifiers

CVE-2026-40214
GHSA-mmpc-xjxr-5hf8
PYSEC-2026-2854

Timeline

2026-03-12: disclosed: Bug reported to OpenStack Launchpad
2026-05-07: advisory: OpenStack Security Advisory OSSA-2026-011 published
2026-05-08: patched: GitHub Advisory published and patches confirmed available

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.