Executive brief
OpenStack Cyborg, a service for managing hardware accelerators like GPUs and FPGAs, contains a flaw where it fails to verify which project owns a specific resource. This allows any logged-in user to view, modify, or delete accelerator requests belonging to other customers or projects. In practice, an attacker could disrupt business operations by deleting resources required for virtual machines to start, leading to a cross-tenant denial of service.
Technical details
OpenStack Cyborg fails to enforce project-based access control for Accelerator Request (ARQ) resources. The vulnerability stems from three primary failures: the 'project_id' column in the database is never populated (remaining NULL), database queries lack project-level filtering, and the 'authorize_wsgi' decorator performs self-referential policy checks that compare a caller's project ID against itself rather than the target resource. An authenticated non-admin attacker can exploit this over the network to list all ARQs (disclosing instance UUIDs and hostnames), delete ARQs (preventing VM restarts), or manipulate bindings across different tenants. The issue is resolved in versions 14.0.1, 15.0.1, and 16.0.1.
Affected products
- OpenStack Cyborg >=3.0.0, <14.0.1; >=15.0.0, <15.0.1; >=16.0.0, <16.0.1
Timeline
- 2026-03-12: disclosed: Bug reported to OpenStack Launchpad
- 2026-05-07: advisory: OpenStack Security Advisory OSSA-2026-011 published
- 2026-05-08: patched: GitHub Advisory published and patches confirmed available