Quick answers
- Is CVE-2026-93854 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-93854 being exploited in the wild.
- How severe is CVE-2026-93854?
- Informational severity, published 18 September 2026.
- Which products and versions are affected?
- OpenStack Blazar before 17.0.1.
- Is there a fix for CVE-2026-93854?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-93854 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-93854?
- Check whether you run OpenStack Blazar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The Blazar V2 Lease API (PUT and DELETE on /v2/leases/{lease_id}) uses a policy authorization wrapper that attempts to load the target lease using kwargs.get("lease_id") to construct the authorization target with the lease owner's project and user IDs. However, the controller methods define the parameter as "id" rather than "lease_id", causing the lookup to return None and authorization to fall back to the authenticated requester's own project/user context instead of the target lease owner. Any authenticated user can bypass object-level authorization by knowing a lease ID, exploiting CWE-639 (Authorization Bypass Through User-Controlled Key).
Affected products
- OpenStack Blazar before 17.0.1
Timeline
- 2026-09-18: disclosed: Published on NVD
- 2026-08-03: other: Bug reported on Launchpad as OSSA-2026-040