Vulnpedia
← Search CVEs

CVE-2026-93856

MEDIUM 4.3

Published 2026-10-21 · Last modified 2026-10-21

In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API. A non-admin user with the project-scoped 'member' or 'reader' role making the Block Storage API v3.3 "List messages" call finds the non-expired user messages for other projects included in the response, resulting in the leakage of UUIDs of resources owned by other projects, in addition to the user message about the other projects' resources (which, by design, are sanitized generic messages). All Cinder deployments are affected.

NO EXPLOITATION SIGNALS

No known exploitation, public exploit, or elevated probability at this time. Track for changes.

Exploitation likelihood

0.4%chance of exploitation in 30 days · 31st percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

4.3CVSS 3.1 · MEDIUM

  • ConfidentialityLow
  • IntegrityNone
  • AvailabilityNone

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ⚠Privileges: Requires a low-privilege account
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Openstack

Products Cinder

Weakness (CWE)

  • CWE-669: Incorrect Resource Transfer Between Spheres

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References and research data (JSON)

Vendor product assessments

  • openstack-cinder as a component of Red Hat OpenStack Platform 13 (Queens) · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/openstack-cinder

    • workaround: Operators can shorten how long these messages remain available by lowering the Cinder message_ttl option. The default is 2592000 seconds (30 days). A periodic task removes expired messages. That task runs on the message_reap_interval, which defaults to 86400 seconds (24 hours). This reduces the window during which another project's error messages can be listed. It does not prevent the list API from returning messages that have not yet expired.
    • none available: Fix deferred
    Red Hat · CVE-2026-93856 · Updated 2026-10-21T05:55:16+00:00
  • openstack-cinder.src as a component of Red Hat OpenStack Platform 13 (Queens) · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/openstack-cinder?arch=src

    • workaround: Operators can shorten how long these messages remain available by lowering the Cinder message_ttl option. The default is 2592000 seconds (30 days). A periodic task removes expired messages. That task runs on the message_reap_interval, which defaults to 86400 seconds (24 hours). This reduces the window during which another project's error messages can be listed. It does not prevent the list API from returning messages that have not yet expired.
    • none available: Fix deferred
    Red Hat · CVE-2026-93856 · Updated 2026-10-21T05:55:16+00:00
  • python-cinder as a component of Red Hat OpenStack Platform 13 (Queens) · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/python-cinder

    • workaround: Operators can shorten how long these messages remain available by lowering the Cinder message_ttl option. The default is 2592000 seconds (30 days). A periodic task removes expired messages. That task runs on the message_reap_interval, which defaults to 86400 seconds (24 hours). This reduces the window during which another project's error messages can be listed. It does not prevent the list API from returning messages that have not yet expired.
    • none available: Fix deferred
    Red Hat · CVE-2026-93856 · Updated 2026-10-21T05:55:16+00:00
  • openstack-cinder as a component of Red Hat OpenStack Platform 16.2 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/openstack-cinder

    • workaround: Operators can shorten how long these messages remain available by lowering the Cinder message_ttl option. The default is 2592000 seconds (30 days). A periodic task removes expired messages. That task runs on the message_reap_interval, which defaults to 86400 seconds (24 hours). This reduces the window during which another project's error messages can be listed. It does not prevent the list API from returning messages that have not yet expired.
    • none available: Fix deferred
    Red Hat · CVE-2026-93856 · Updated 2026-10-21T05:55:16+00:00
  • openstack-cinder.src as a component of Red Hat OpenStack Platform 16.2 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/openstack-cinder?arch=src

    • workaround: Operators can shorten how long these messages remain available by lowering the Cinder message_ttl option. The default is 2592000 seconds (30 days). A periodic task removes expired messages. That task runs on the message_reap_interval, which defaults to 86400 seconds (24 hours). This reduces the window during which another project's error messages can be listed. It does not prevent the list API from returning messages that have not yet expired.
    • none available: Fix deferred
    Red Hat · CVE-2026-93856 · Updated 2026-10-21T05:55:16+00:00
  • python3-cinder as a component of Red Hat OpenStack Platform 16.2 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/python3-cinder

    • workaround: Operators can shorten how long these messages remain available by lowering the Cinder message_ttl option. The default is 2592000 seconds (30 days). A periodic task removes expired messages. That task runs on the message_reap_interval, which defaults to 86400 seconds (24 hours). This reduces the window during which another project's error messages can be listed. It does not prevent the list API from returning messages that have not yet expired.
    • none available: Fix deferred
    Red Hat · CVE-2026-93856 · Updated 2026-10-21T05:55:16+00:00
  • openstack-cinder as a component of Red Hat OpenStack Platform 17.1 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/openstack-cinder

    • workaround: Operators can shorten how long these messages remain available by lowering the Cinder message_ttl option. The default is 2592000 seconds (30 days). A periodic task removes expired messages. That task runs on the message_reap_interval, which defaults to 86400 seconds (24 hours). This reduces the window during which another project's error messages can be listed. It does not prevent the list API from returning messages that have not yet expired.
    • none available: Fix deferred
    Red Hat · CVE-2026-93856 · Updated 2026-10-21T05:55:16+00:00
  • openstack-cinder.src as a component of Red Hat OpenStack Platform 17.1 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/openstack-cinder?arch=src

    • workaround: Operators can shorten how long these messages remain available by lowering the Cinder message_ttl option. The default is 2592000 seconds (30 days). A periodic task removes expired messages. That task runs on the message_reap_interval, which defaults to 86400 seconds (24 hours). This reduces the window during which another project's error messages can be listed. It does not prevent the list API from returning messages that have not yet expired.
    • none available: Fix deferred
    Red Hat · CVE-2026-93856 · Updated 2026-10-21T05:55:16+00:00
  • python3-cinder as a component of Red Hat OpenStack Platform 17.1 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/python3-cinder

    • workaround: Operators can shorten how long these messages remain available by lowering the Cinder message_ttl option. The default is 2592000 seconds (30 days). A periodic task removes expired messages. That task runs on the message_reap_interval, which defaults to 86400 seconds (24 hours). This reduces the window during which another project's error messages can be listed. It does not prevent the list API from returning messages that have not yet expired.
    • none available: Fix deferred
    Red Hat · CVE-2026-93856 · Updated 2026-10-21T05:55:16+00:00
  • python3-cinder-common as a component of Red Hat OpenStack Platform 17.1 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/python3-cinder-common

    • workaround: Operators can shorten how long these messages remain available by lowering the Cinder message_ttl option. The default is 2592000 seconds (30 days). A periodic task removes expired messages. That task runs on the message_reap_interval, which defaults to 86400 seconds (24 hours). This reduces the window during which another project's error messages can be listed. It does not prevent the list API from returning messages that have not yet expired.
    • none available: Fix deferred
    Red Hat · CVE-2026-93856 · Updated 2026-10-21T05:55:16+00:00
  • openstack-cinder.src as a component of Red Hat OpenStack Platform 18.0 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/openstack-cinder?arch=src

    • workaround: Operators can shorten how long these messages remain available by lowering the Cinder message_ttl option. The default is 2592000 seconds (30 days). A periodic task removes expired messages. That task runs on the message_reap_interval, which defaults to 86400 seconds (24 hours). This reduces the window during which another project's error messages can be listed. It does not prevent the list API from returning messages that have not yet expired.
    • none available: Fix deferred
    Red Hat · CVE-2026-93856 · Updated 2026-10-21T05:55:16+00:00

All CVSS metrics

  • MEDIUM 4.3 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
  • MEDIUM 4.3 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

Exploit-tagged references (not proof of a PoC)

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS