# CVE-2026-93854: OpenStack Blazar authorization bypass in Lease API

Source: https://junglewise.ai/threats/cve-2026-93854-in-openstack-blazar-before-17-0-1-the-v2-lease-api-does-not  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-18. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-93854 · Severity: info · Published 2026-09-18

OpenStack Blazar manages and schedules cloud computing resources across a pool of machines. An authenticated user can modify or delete leases belonging to other users and projects due to a parameter naming mismatch that breaks the authorization check. This allows attackers who know a lease ID to bypass ownership controls and sabotage or steal compute resource allocations.

Vendors: [OpenStack](https://junglewise.ai/threats/vendors/openstack).

## Quick answers

**Is CVE-2026-93854 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-93854 being exploited in the wild.

**How severe is CVE-2026-93854?** Informational severity, published 18 September 2026.

**Which products and versions are affected?** OpenStack Blazar before 17.0.1.

**Is there a fix for CVE-2026-93854?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-93854 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-93854?** Check whether you run OpenStack Blazar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Blazar V2 Lease API (PUT and DELETE on /v2/leases/{lease_id}) uses a policy authorization wrapper that attempts to load the target lease using kwargs.get("lease_id") to construct the authorization target with the lease owner's project and user IDs. However, the controller methods define the parameter as "id" rather than "lease_id", causing the lookup to return None and authorization to fall back to the authenticated requester's own project/user context instead of the target lease owner. Any authenticated user can bypass object-level authorization by knowing a lease ID, exploiting CWE-639 (Authorization Bypass Through User-Controlled Key).

## Affected products

- OpenStack Blazar before 17.0.1

## Timeline

- 2026-09-18: disclosed: Published on NVD
- 2026-08-03: other: Bug reported on Launchpad as OSSA-2026-040

## References

- [https://launchpad.net/bugs/2162719](https://launchpad.net/bugs/2162719)

## Related threats

- [OpenStack Blazar authorization bypass in Lease API](https://junglewise.ai/threats/cve-2026-93852-in-openstack-blazar-before-17-0-1-the-v2-lease-listing-operation)