# CVE-2026-71195: OpenStack Manila cross-project authorization bypass on public shares

Source: https://junglewise.ai/threats/cve-2026-71195-in-openstack-manila-before-23-0-1-multiple-manila-api-operations  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-71195 · Severity: critical · CVSS 9.9 · Published 2026-10-21

OpenStack Manila is a file-sharing service for cloud deployments. A critical authorization flaw allows any authenticated user to modify, delete, or back up another organization's public shares, and to change access rules and metadata—potentially disrupting legitimate access or exposing data. This affects Manila's public-share visibility mechanism, which was never intended to grant management authority over foreign shares.

Vendors: [OpenStack](https://junglewise.ai/threats/vendors/openstack).

## Quick answers

**Is CVE-2026-71195 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-71195 being exploited in the wild.

**How severe is CVE-2026-71195?** Critical severity, with a CVSS score of 9.9, published 21 October 2026.

**Which products and versions are affected?** OpenStack Manila >=1.0.0 <20.0.3, >=21.0.0 <21.0.3, >=22.0.0 <22.0.2, ==23.0.0.

**Is there a fix for CVE-2026-71195?** Yes: fixed in 20.0.3, 21.0.3, 22.0.2, 23.0.1 (and later stable releases 2025.1, 2025.2, 2026.1, 2026.2, 2027.1). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-71195 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-71195?** Check whether you run OpenStack Manila at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 20.0.3, 21.0.3, 22.0.2, 23.0.1 (and later stable releases 2025.1, 2025.2, 2026.1, 2026.2, 2027.1)

## Technical details

The vulnerability is an authorization bypass in Manila's API controllers: policy authorization occurs against the caller's project context before the target share is loaded, and when a public share is subsequently fetched, no re-authorization check validates that the caller owns it. This affects allow_access, deny_access, update_access, create_share_backup, soft_delete, restore, and export-location metadata operations. Any authenticated project member can exploit these operations on any public share via the visible share UUID.

## Affected products

- OpenStack Manila >=1.0.0 <20.0.3, >=21.0.0 <21.0.3, >=22.0.0 <22.0.2, ==23.0.0

## Timeline

- 2026-10-20: disclosed

## References

- [https://launchpad.net/bugs/2161412](https://launchpad.net/bugs/2161412)
- [https://openwall.com/lists/oss-security/2026/10/20/18](https://openwall.com/lists/oss-security/2026/10/20/18)