CVE catalog

CVE-2026-71195

manila: CVE-2026-71195

Severity: Critical · CVSS 9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Published: Oct 20, 2026, 3:00:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.48% · Oct 25, 2026

In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize operations against the caller's own project context, then load a foreign public share without re-authorizing against the share's actual owner. This affects the following operations: allow_access: grant data-plane read/write access to another tenant's share; deny_access: revoke the owner's existing access rules; update_access: escalate access level (e.g., ro to rw); create_share_backup: exfiltrate share data via a backup created under the attacker's project; soft_delete: move a foreign share to the recycle bin; restore: interfere with the owner's deletion workflow; export location metadata: create, update, and delete metadata on foreign export locations; access rule listing: disclose IPs, usernames, and CephFS keys. Any authenticated project member can exploit these operations on any public share. The share UUID is visible since the share is public.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	manila	sid	`1:23.0.0-4`	fixed
Debian	manila	forky	`1:22.0.1-1`	vulnerable
Debian	manila	trixie	`1:20.0.0-3`	vulnerable
Debian	manila	bookworm	`1:15.1.0-2`	vulnerable
Ubuntu	manila	16.04	`1:1.0.0-0ubuntu1`	vulnerable
Ubuntu	manila	16.04	`1:2.0.0~b1-0ubuntu1`	vulnerable
Ubuntu	manila	16.04	`1:2.0.0~b2-0ubuntu1`	vulnerable
Ubuntu	manila	16.04	`1:2.0.0~b3-0ubuntu1`	vulnerable
Ubuntu	manila	16.04	`1:2.0.0~rc1-0ubuntu1`	vulnerable
Ubuntu	manila	16.04	`1:2.0.0-0ubuntu1`	vulnerable
Ubuntu	manila	18.04	`1:5.0.0-0ubuntu1`	vulnerable
Ubuntu	manila	18.04	`1:6.0.0~b2-0ubuntu1`	vulnerable
Ubuntu	manila	18.04	`1:6.0.0~b3-0ubuntu1`	vulnerable
Ubuntu	manila	18.04	`1:6.0.0~rc1-0ubuntu1`	vulnerable
Ubuntu	manila	18.04	`1:6.0.0~rc2-0ubuntu1`	vulnerable
Ubuntu	manila	18.04	`1:6.0.0~rc3-0ubuntu1`	vulnerable
Ubuntu	manila	18.04	`1:6.0.0-0ubuntu1`	vulnerable
Ubuntu	manila	20.04	`1:9.0.0-0ubuntu1`	vulnerable
Ubuntu	manila	20.04	`1:10.0.0~b1~git2019121913.02b2903f-0ubuntu1`	vulnerable
Ubuntu	manila	20.04	`1:10.0.0~b2~git2020020609.19877429-0ubuntu1`	vulnerable
Ubuntu	manila	20.04	`1:10.0.0~b3~git2020032516.cb016333-0ubuntu1`	vulnerable
Ubuntu	manila	20.04	`1:10.0.0~b3~git2020041013.ea90fd17-0ubuntu1`	vulnerable
Ubuntu	manila	20.04	`1:10.0.0-0ubuntu0.20.04.1`	vulnerable
Ubuntu	manila	20.04	`1:10.0.0-0ubuntu0.20.04.2`	vulnerable
Ubuntu	manila	22.04	`1:13.0.0-0ubuntu1`	vulnerable
Ubuntu	manila	22.04	`1:13.0.1+git2021120816.1856bf632-0ubuntu1`	vulnerable
Ubuntu	manila	22.04	`1:13.0.1+git2022011217.603e484fb-0ubuntu1`	vulnerable
Ubuntu	manila	22.04	`1:13.0.1+git2022011217.603e484fb-0ubuntu2`	vulnerable
Ubuntu	manila	22.04	`1:13.0.2+git2022030313.3ce3854ae-0ubuntu1`	vulnerable
Ubuntu	manila	22.04	`1:14.0.0-0ubuntu1`	vulnerable
Ubuntu	manila	22.04	`1:14.0.1-0ubuntu1`	vulnerable
Ubuntu	manila	22.04	`1:14.1.0-0ubuntu1`	vulnerable
Ubuntu	manila	22.04	`1:14.1.1-0ubuntu1`	vulnerable
Ubuntu	manila	22.04	`1:14.1.1-0ubuntu1.1`	vulnerable
Ubuntu	manila	22.04	`1:14.1.1-0ubuntu1.2`	vulnerable
Ubuntu	manila	22.04	`1:14.1.1-0ubuntu1.3`	vulnerable
Ubuntu	manila	24.04	`1:17.0.0-0ubuntu1`	vulnerable
Ubuntu	manila	24.04	`1:17.2.0+git2024020611.796037ea-0ubuntu1`	vulnerable
Ubuntu	manila	24.04	`1:18.0.0~rc1-0ubuntu1`	vulnerable
Ubuntu	manila	24.04	`1:18.0.1-0ubuntu1`	vulnerable
Ubuntu	manila	24.04	`1:18.0.1-0ubuntu2`	vulnerable
Ubuntu	manila	24.04	`1:18.0.1-0ubuntu2.1`	vulnerable
Ubuntu	manila	24.04	`1:18.0.1-0ubuntu2.2`	vulnerable
Ubuntu	manila	24.04	`1:18.0.1-0ubuntu2.3`	vulnerable
Ubuntu	manila	26.10	`1:22.0.0-0ubuntu2`	vulnerable
Ubuntu	manila	26.10	`1:22.0.0+git20260814.232.57a2239-0ubuntu1`	vulnerable
Ubuntu	manila	26.10	`1:23.0.0~rc1-0ubuntu1`	vulnerable
Ubuntu	manila	26.10	`1:23.0.0-0ubuntu1`	vulnerable
Ubuntu	manila	26.04	`1:21.0.0-0ubuntu1`	vulnerable
Ubuntu	manila	26.04	`1:21.0.0+git20260126.6017d99-0ubuntu1`	vulnerable
Ubuntu	manila	26.04	`1:22.0.0~rc2-0ubuntu1`	vulnerable
Ubuntu	manila	26.04	`1:22.0.0-0ubuntu1`	vulnerable
Ubuntu	manila	26.04	`1:22.0.0-0ubuntu2`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	manila	source	sid	`1:23.0.0-4`	not yet assigned	Not reported	[1151439]
Debian	manila	source	forky	`(unfixed)`	not yet assigned	Not reported	[1151439]
Debian	manila	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1151439]
Debian	manila	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1151439]

[Debian bug #1151439]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[manila-api]Affected
Source package: [manila]
Details (2)
- 1:15.1.0-2 · all · bookworm
  Affected
  dsa · manila · debian · bookworm; dsa · manila · debian · 12
- 1:15.1.0-2 · all · bookworm
  Affected
  dsa · manila · debian · bookworm; dsa · manila · debian · 12
[manila-common]Affected
Source package: [manila]
Details (2)
- 1:15.1.0-2 · all · bookworm
  Affected
  dsa · manila · debian · bookworm; dsa · manila · debian · 12
- 1:15.1.0-2 · all · bookworm
  Affected
  dsa · manila · debian · bookworm; dsa · manila · debian · 12
[manila-data]Affected
Source package: [manila]
Details (2)
- 1:15.1.0-2 · all · bookworm
  Affected
  dsa · manila · debian · bookworm; dsa · manila · debian · 12
- 1:15.1.0-2 · all · bookworm
  Affected
  dsa · manila · debian · bookworm; dsa · manila · debian · 12
[manila-doc]Affected
Source package: [manila]
Details (2)
- 1:15.1.0-2 · all · bookworm
  Affected
  dsa · manila · debian · bookworm; dsa · manila · debian · 12
- 1:15.1.0-2 · all · bookworm
  Affected
  dsa · manila · debian · bookworm; dsa · manila · debian · 12
[manila-scheduler]Affected
Source package: [manila]
Details (2)
- 1:15.1.0-2 · all · bookworm
  Affected
  dsa · manila · debian · bookworm; dsa · manila · debian · 12
- 1:15.1.0-2 · all · bookworm
  Affected
  dsa · manila · debian · bookworm; dsa · manila · debian · 12
[manila-share]Affected
Source package: [manila]
Details (2)
- 1:15.1.0-2 · all · bookworm
  Affected
  dsa · manila · debian · bookworm; dsa · manila · debian · 12
- 1:15.1.0-2 · all · bookworm
  Affected
  dsa · manila · debian · bookworm; dsa · manila · debian · 12
[python3-manila]Affected
Source package: [manila]
Details (2)
- 1:15.1.0-2 · all · bookworm
  Affected
  dsa · manila · debian · bookworm; dsa · manila · debian · 12
- 1:15.1.0-2 · all · bookworm
  Affected
  dsa · manila · debian · bookworm; dsa · manila · debian · 12

[Debian 13 (Trixie)]

[manila-api]Affected
Source package: [manila]
Details (2)
- 1:20.0.0-3 · all · trixie
  Affected
  dsa · manila · debian · 13
- 1:20.0.0-3 · all · trixie
  Affected
  dsa · manila · debian · 13
[manila-common]Affected
Source package: [manila]
Details (2)
- 1:20.0.0-3 · all · trixie
  Affected
  dsa · manila · debian · 13
- 1:20.0.0-3 · all · trixie
  Affected
  dsa · manila · debian · 13
[manila-data]Affected
Source package: [manila]
Details (2)
- 1:20.0.0-3 · all · trixie
  Affected
  dsa · manila · debian · 13
- 1:20.0.0-3 · all · trixie
  Affected
  dsa · manila · debian · 13
[manila-doc]Affected
Source package: [manila]
Details (2)
- 1:20.0.0-3 · all · trixie
  Affected
  dsa · manila · debian · 13
- 1:20.0.0-3 · all · trixie
  Affected
  dsa · manila · debian · 13
[manila-scheduler]Affected
Source package: [manila]
Details (2)
- 1:20.0.0-3 · all · trixie
  Affected
  dsa · manila · debian · 13
- 1:20.0.0-3 · all · trixie
  Affected
  dsa · manila · debian · 13
[manila-share]Affected
Source package: [manila]
Details (2)
- 1:20.0.0-3 · all · trixie
  Affected
  dsa · manila · debian · 13
- 1:20.0.0-3 · all · trixie
  Affected
  dsa · manila · debian · 13
[python3-manila]Affected
Source package: [manila]
Details (2)
- 1:20.0.0-3 · all · trixie
  Affected
  dsa · manila · debian · 13
- 1:20.0.0-3 · all · trixie
  Affected
  dsa · manila · debian · 13

Observed: Oct 25, 2026, 2:57:19 AM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]