CVE-Katalog

CVE-2026-40213

DEBIAN-

[CVE-Katalog]

OpenStack Cyborg before 16.0.1 uses rule:allow (check_str='@') as the default policy for multiple API endpoints. This unconditionally authorizes any request carrying a valid Keystone token regardless of roles, project membership, or scope. An authenticated user with zero role assignments can complete various actions such as reprogramming FPGA bitstreams on arbitrary compute nodes via agent RPC.

Schweregrad
Unbekannt · CVSS 7.4CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.21% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Ubuntu26.04cyborg14.0.0-3UnknownSource applicability is not established[USN-8413-1][UBUNTU-CVE-2026-40213]
Ubuntu26.04cyborg15.0.0-1UnknownSource applicability is not established[USN-8413-1][UBUNTU-CVE-2026-40213]
Ubuntu26.04cyborg16.0.0-2UnknownSource applicability is not established[USN-8413-1][UBUNTU-CVE-2026-40213]
Ubuntu26.04cyborg16.0.0-2ubuntu0.1UnknownSource applicability is not established[USN-8413-1][UBUNTU-CVE-2026-40213]
Ubuntu26.04cyborg16.0.0~rc1-2UnknownSource applicability is not established[USN-8413-1][UBUNTU-CVE-2026-40213]
Ubuntu25.10cyborg13.0.0-2UnknownSource applicability is not established[USN-8413-1][UBUNTU-CVE-2026-40213]
Ubuntu25.10cyborg14.0.0-2UnknownSource applicability is not established[USN-8413-1][UBUNTU-CVE-2026-40213]
Ubuntu25.10cyborg14.0.0-3UnknownSource applicability is not established[USN-8413-1][UBUNTU-CVE-2026-40213]
Ubuntu25.10cyborg14.0.0-3+deb13u1build0.25.10.1UnknownSource applicability is not established[USN-8413-1][UBUNTU-CVE-2026-40213]
Debian14cyborg14.0.0-3UnknownSource applicability is not established[DEBIAN-CVE-2026-40213]
Debian14cyborg15.0.0-1UnknownSource applicability is not established[DEBIAN-CVE-2026-40213]
Debian14cyborg15.0.0~rc1-1UnknownSource applicability is not established[DEBIAN-CVE-2026-40213]

Showing 12 observations. All 22 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
Debian13cyborg14.0.0-3UnknownSource applicability is not established[DEBIAN-CVE-2026-40213]
Debian13cyborg14.0.0-3+deb13u1UnknownSource applicability is not established[DEBIAN-CVE-2026-40213]
Debian14cyborg14.0.0-3UnknownSource applicability is not established[DEBIAN-CVE-2026-40213]
Debian14cyborg15.0.0-1UnknownSource applicability is not established[DEBIAN-CVE-2026-40213]
Debian14cyborg15.0.0~rc1-1UnknownSource applicability is not established[DEBIAN-CVE-2026-40213]
Debian14cyborg15.0.0~rc1-2UnknownSource applicability is not established[DEBIAN-CVE-2026-40213]
Debian14cyborg15.0.0~rc1-3UnknownSource applicability is not established[DEBIAN-CVE-2026-40213]
Debian14cyborg16.0.0+git+2026.04.26.b8edfa06f1-1UnknownSource applicability is not established[DEBIAN-CVE-2026-40213]
Debian14cyborg16.0.0-1UnknownSource applicability is not established[DEBIAN-CVE-2026-40213]
Debian14cyborg16.0.0-2UnknownSource applicability is not established[DEBIAN-CVE-2026-40213]
Debian14cyborg16.0.0~rc1-1UnknownSource applicability is not established[DEBIAN-CVE-2026-40213]
Debian14cyborg16.0.0~rc1-2UnknownSource applicability is not established[DEBIAN-CVE-2026-40213]
Debian14cyborg16.0.0~rc2-1UnknownSource applicability is not established[DEBIAN-CVE-2026-40213]
Ubuntu25.10cyborg13.0.0-2UnknownSource applicability is not established[USN-8413-1][UBUNTU-CVE-2026-40213]
Ubuntu25.10cyborg14.0.0-2UnknownSource applicability is not established[USN-8413-1][UBUNTU-CVE-2026-40213]
Ubuntu25.10cyborg14.0.0-3UnknownSource applicability is not established[USN-8413-1][UBUNTU-CVE-2026-40213]
Ubuntu25.10cyborg14.0.0-3+deb13u1build0.25.10.1UnknownSource applicability is not established[USN-8413-1][UBUNTU-CVE-2026-40213]
Ubuntu26.04cyborg14.0.0-3UnknownSource applicability is not established[USN-8413-1][UBUNTU-CVE-2026-40213]
Ubuntu26.04cyborg15.0.0-1UnknownSource applicability is not established[USN-8413-1][UBUNTU-CVE-2026-40213]
Ubuntu26.04cyborg16.0.0-2UnknownSource applicability is not established[USN-8413-1][UBUNTU-CVE-2026-40213]
Ubuntu26.04cyborg16.0.0-2ubuntu0.1UnknownSource applicability is not established[USN-8413-1][UBUNTU-CVE-2026-40213]
Ubuntu26.04cyborg16.0.0~rc1-2UnknownSource applicability is not established[USN-8413-1][UBUNTU-CVE-2026-40213]
Original provider fields
{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "cyborg",
      "distro": "debian",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "14.0.0-3+deb13u1"
            }
          ]
        }
      ],
      "release": "13",
      "versions": [
        "14.0.0-3"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/DEBIAN-CVE-2026-40213",
      "fixed_version": "14.0.0-3+deb13u1",
      "provider_source": "pypi",
      "provider_record_id": "DEBIAN-CVE-2026-40213",
      "provider_updated_at": "2026-10-26T11:47:33.612229870Z",
      "applicability_unknown": true
    },
    {
      "name": "cyborg",
      "distro": "debian",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "16.0.0+git+2026.04.26.b8edfa06f1-1"
            }
          ]
        }
      ],
      "release": "14",
      "versions": [
        "14.0.0-3",
        "15.0.0-1",
        "15.0.0~rc1-1",
        "15.0.0~rc1-2",
        "15.0.0~rc1-3",
        "16.0.0-1",
        "16.0.0-2",
        "16.0.0~rc1-1",
        "16.0.0~rc1-2",
        "16.0.0~rc2-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/DEBIAN-CVE-2026-40213",
      "fixed_version": "16.0.0+git+2026.04.26.b8edfa06f1-1",
      "provider_source": "pypi",
      "provider_record_id": "DEBIAN-CVE-2026-40213",
      "provider_updated_at": "2026-10-26T11:47:33.612229870Z",
      "applicability_unknown": true
    },
    {
      "name": "cyborg",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "14.0.0-3+deb13u1build0.25.10.1"
            }
          ]
        }
      ],
      "release": "25.10",
      "versions": [
        "13.0.0-2",
        "14.0.0-2",
        "14.0.0-3"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-8413-1",
      "fixed_version": "14.0.0-3+deb13u1build0.25.10.1",
      "provider_source": "pypi",
      "provider_record_id": "USN-8413-1",
      "provider_updated_at": "2026-06-09T21:29:23.859315177Z",
      "applicability_unknown": true
    },
    {
      "name": "cyborg",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "16.0.0-2ubuntu0.1"
            }
          ]
        }
      ],
      "release": "26.04",
      "versions": [
        "14.0.0-3",
        "15.0.0-1",
        "16.0.0~rc1-2",
        "16.0.0-2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-8413-1",
      "fixed_version": "16.0.0-2ubuntu0.1",
      "provider_source": "pypi",
      "provider_record_id": "USN-8413-1",
      "provider_updated_at": "2026-06-09T21:29:23.859315177Z",
      "applicability_unknown": true
    },
    {
      "name": "cyborg",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "14.0.0-3+deb13u1build0.25.10.1"
            }
          ]
        }
      ],
      "release": "25.10",
      "versions": [
        "13.0.0-2",
        "14.0.0-2",
        "14.0.0-3"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-40213",
      "fixed_version": "14.0.0-3+deb13u1build0.25.10.1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-40213",
      "provider_updated_at": "2026-06-09T21:19:11.290788631Z",
      "applicability_unknown": true
    },
    {
      "name": "cyborg",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "16.0.0-2ubuntu0.1"
            }
          ]
        }
      ],
      "release": "26.04",
      "versions": [
        "14.0.0-3",
        "15.0.0-1",
        "16.0.0~rc1-2",
        "16.0.0-2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-40213",
      "fixed_version": "16.0.0-2ubuntu0.1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2026-40213",
      "provider_updated_at": "2026-06-09T21:19:11.290788631Z",
      "applicability_unknown": true
    }
  ]
}

OpenFactory catalog packages

Die Paketzuordnung läuft.

[Debian 13 (Trixie)]

  • [cyborg-agent]Unbekannt

    Quellpaket: [cyborg]

    Details (4)

    • 14.0.0-3+deb13u1 · all · trixie

      Behoben · Behoben: 14.0.0-3+deb13u1

      pypi · cyborg · debian · 13

    • 14.0.0-3+deb13u1 · all · trixie

      Behoben · Behoben: 14.0.0-3+deb13u1

      pypi · cyborg · debian · 13

    • 14.0.0-3+deb13u1 · all · trixie-security

      Behoben · Behoben: 14.0.0-3+deb13u1

      pypi · cyborg · debian · 13

    • 14.0.0-3+deb13u1 · all · trixie-security

      Behoben · Behoben: 14.0.0-3+deb13u1

      pypi · cyborg · debian · 13

  • [cyborg-api]Unbekannt

    Quellpaket: [cyborg]

    Details (4)

    • 14.0.0-3+deb13u1 · all · trixie

      Behoben · Behoben: 14.0.0-3+deb13u1

      pypi · cyborg · debian · 13

    • 14.0.0-3+deb13u1 · all · trixie

      Behoben · Behoben: 14.0.0-3+deb13u1

      pypi · cyborg · debian · 13

    • 14.0.0-3+deb13u1 · all · trixie-security

      Behoben · Behoben: 14.0.0-3+deb13u1

      pypi · cyborg · debian · 13

    • 14.0.0-3+deb13u1 · all · trixie-security

      Behoben · Behoben: 14.0.0-3+deb13u1

      pypi · cyborg · debian · 13

  • [cyborg-common]Unbekannt

    Quellpaket: [cyborg]

    Details (4)

    • 14.0.0-3+deb13u1 · all · trixie

      Behoben · Behoben: 14.0.0-3+deb13u1

      pypi · cyborg · debian · 13

    • 14.0.0-3+deb13u1 · all · trixie

      Behoben · Behoben: 14.0.0-3+deb13u1

      pypi · cyborg · debian · 13

    • 14.0.0-3+deb13u1 · all · trixie-security

      Behoben · Behoben: 14.0.0-3+deb13u1

      pypi · cyborg · debian · 13

    • 14.0.0-3+deb13u1 · all · trixie-security

      Behoben · Behoben: 14.0.0-3+deb13u1

      pypi · cyborg · debian · 13

  • [cyborg-conductor]Unbekannt

    Quellpaket: [cyborg]

    Details (4)

    • 14.0.0-3+deb13u1 · all · trixie

      Behoben · Behoben: 14.0.0-3+deb13u1

      pypi · cyborg · debian · 13

    • 14.0.0-3+deb13u1 · all · trixie

      Behoben · Behoben: 14.0.0-3+deb13u1

      pypi · cyborg · debian · 13

    • 14.0.0-3+deb13u1 · all · trixie-security

      Behoben · Behoben: 14.0.0-3+deb13u1

      pypi · cyborg · debian · 13

    • 14.0.0-3+deb13u1 · all · trixie-security

      Behoben · Behoben: 14.0.0-3+deb13u1

      pypi · cyborg · debian · 13

  • [cyborg-doc]Unbekannt

    Quellpaket: [cyborg]

    Details (4)

    • 14.0.0-3+deb13u1 · all · trixie

      Behoben · Behoben: 14.0.0-3+deb13u1

      pypi · cyborg · debian · 13

    • 14.0.0-3+deb13u1 · all · trixie

      Behoben · Behoben: 14.0.0-3+deb13u1

      pypi · cyborg · debian · 13

    • 14.0.0-3+deb13u1 · all · trixie-security

      Behoben · Behoben: 14.0.0-3+deb13u1

      pypi · cyborg · debian · 13

    • 14.0.0-3+deb13u1 · all · trixie-security

      Behoben · Behoben: 14.0.0-3+deb13u1

      pypi · cyborg · debian · 13

  • [python3-cyborg]Unbekannt

    Quellpaket: [cyborg]

    Details (4)

    • 14.0.0-3+deb13u1 · all · trixie

      Behoben · Behoben: 14.0.0-3+deb13u1

      pypi · cyborg · debian · 13

    • 14.0.0-3+deb13u1 · all · trixie

      Behoben · Behoben: 14.0.0-3+deb13u1

      pypi · cyborg · debian · 13

    • 14.0.0-3+deb13u1 · all · trixie-security

      Behoben · Behoben: 14.0.0-3+deb13u1

      pypi · cyborg · debian · 13

    • 14.0.0-3+deb13u1 · all · trixie-security

      Behoben · Behoben: 14.0.0-3+deb13u1

      pypi · cyborg · debian · 13

Beobachtet:

Referenzen

[FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]