Executive brief
OpenStack Blazar is a resource reservation service used in cloud environments to manage long-term compute and storage leases. Due to a parameter naming mismatch in the API authorization logic, authenticated users can modify or delete leases belonging to other tenants, potentially disrupting their cloud operations or accessing sensitive reservation metadata. This affects the core authorization mechanism protecting lease resources across different projects.
Technical details
A parameter naming inconsistency between the API controller (uses "id") and the authorization policy enforcement layer (expects "lease_id") causes the authorization wrapper to fail to retrieve the target lease object during authorization checks. When authorization cannot identify the target lease, it falls back to checking permissions against the requester's own project context instead of the lease owner's context, allowing any authenticated API user to bypass object-level authorization. The vulnerability affects PUT and DELETE operations on /v2/leases/{lease_id} endpoints.
Affected products
- OpenStack Blazar before 17.0.1
Timeline
- 2026-09-18: disclosed
- 2026-08-03: other: vulnerability reported