OpenStack Manila Authenticated Cross-Project Manipulation of Public Shares in CVE-2026-71195

Authenticated users in OpenStack Manila can now alter public shares belonging to other projects, granting them the ability to exfiltrate data or disrupt services. This capability arises because the system fails to verify ownership when processing API requests for public resources. Attackers need only a valid account and the public share identifier to execute these actions, bypassing project isolation boundaries entirely.

How it unfolded

• Chen YuXiang disclosed the vulnerability, which was assigned CVE-2026-71195.
• Goutham Pacha Ravi posted the official advisory on October 20, 2026, via the oss-security mailing list.
• The National Vulnerability Database recorded the flaw with a CVSS score of 9.9, rating it critical.

Who is affected

Organizations using OpenStack Manila versions 1.0.0 through 20.0.2, 21.0.0 through 21.0.2, 22.0.0 through 22.0.1, and 23.0.0 are vulnerable. The flaw impacts any environment where public shares are utilized, as the share UUIDs are inherently visible. Any authenticated member of any project can target these shares, regardless of their relationship to the share owner.

The fix

Upgrading to OpenStack Manila version 20.0.3, 21.0.3, 22.0.2, or 23.0.1 resolves the issue. These releases introduce proper authorization checks that verify the caller owns the share before allowing operations. Administrators should apply these updates promptly to prevent unauthorized cross-project modifications. No other mitigation is confirmed in the source material.

What made it possible

This incident illustrates the risk of insufficient authorization checks in multi-tenant systems. When APIs rely on project context rather than resource ownership, attackers can pivot across boundaries. Teams usually verify that access controls validate ownership for every sensitive operation, not just initial authentication. Check whether your system re-authorizes actions against the specific resource owner, especially for public-facing assets. This prevents lateral movement and ensures that users cannot manipulate resources they do not own, maintaining strict isolation between tenants.

What to do and how to stay safe: OpenStack

• Audit all public shares to identify those with sensitive data or critical access rules.
• Monitor API logs for unusual operations on public shares, such as unexpected backup creations or access changes.
• Restrict public share usage to non-sensitive data until patches are applied across all environments.
• Review access control configurations to ensure ownership verification is enforced for all share-related actions.

Step-by-step guide: What Is Virtual Patching: How It Works Without Code Changes

General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What can an attacker do with CVE-2026-71195?

They can grant or revoke access, escalate privileges, create backups to exfiltrate data, and modify metadata on public shares.

Which OpenStack Manila versions are affected?

Versions before 20.0.3, before 21.0.3, before 22.0.2, and before 23.0.1 are vulnerable to this flaw.

Is a patch available for CVE-2026-71195?

Yes, updates are available in versions 20.0.3, 21.0.3, 22.0.2, and 23.0.1.