CVE catalog

CVE-2026-93856

cinder: CVE-2026-93856

[CVE catalog]

Severity
Medium · CVSS 4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.37% · Oct 25, 2026

In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API. A non-admin user with the project-scoped 'member' or 'reader' role making the Block Storage API v3.3 "List messages" call finds the non-expired user messages for other projects included in the response, resulting in the leakage of UUIDs of resources owned by other projects, in addition to the user message about the other projects' resources (which, by design, are sanitized generic messages). All Cinder deployments are affected.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiancindersid2:29.0.0-3fixed
Debiancinderforky2:28.0.0-1vulnerable
Debiancindertrixie2:26.0.0-2vulnerable
Debiancinderbookworm2:21.3.1-1~deb12u1vulnerable
Debiancinderbookworm-security2:21.3.1-1~deb12u1vulnerable
Ubuntucinder16.042:7.0.0-0ubuntu1vulnerable
Ubuntucinder16.042:8.0.0~b1-0ubuntu1vulnerable
Ubuntucinder16.042:8.0.0~b2-0ubuntu2vulnerable
Ubuntucinder16.042:8.0.0~b3-0ubuntu2vulnerable
Ubuntucinder16.042:8.0.0~rc1-0ubuntu2vulnerable
Ubuntucinder16.042:8.0.0-0ubuntu1vulnerable
Ubuntucinder16.042:8.1.0-0ubuntu1vulnerable
Ubuntucinder16.042:8.1.1-0ubuntu1vulnerable
Ubuntucinder16.042:8.1.1-0ubuntu3vulnerable
Ubuntucinderpro2:11.0.0-0ubuntu2vulnerable
Ubuntucinderpro2:11.0.0-0ubuntu3vulnerable
Ubuntucinderpro2:12.0.0~b1-0ubuntu1vulnerable
Ubuntucinderpro2:12.0.0~b2-0ubuntu2vulnerable
Ubuntucinderpro2:12.0.0~rc1-0ubuntu1vulnerable
Ubuntucinderpro2:12.0.0~rc2-0ubuntu1vulnerable
Ubuntucinderpro2:12.0.0~rc2-0ubuntu2vulnerable
Ubuntucinderpro2:12.0.0-0ubuntu1vulnerable
Ubuntucinderpro2:12.0.1-0ubuntu1vulnerable
Ubuntucinderpro2:12.0.3-0ubuntu1vulnerable
Ubuntucinderpro2:12.0.4-0ubuntu1vulnerable
Ubuntucinderpro2:12.0.5-0ubuntu1vulnerable
Ubuntucinderpro2:12.0.7-0ubuntu2vulnerable
Ubuntucinderpro2:12.0.9-0ubuntu1vulnerable
Ubuntucinderpro2:12.0.9-0ubuntu1.2vulnerable
Ubuntucinderpro2:12.0.10-0ubuntu1vulnerable
Ubuntucinderpro2:12.0.10-0ubuntu2vulnerable
Ubuntucinderpro2:12.0.10-0ubuntu2.2vulnerable
Ubuntucinderpro2:12.0.10-0ubuntu2.2+esm1vulnerable
Ubuntucinder20.042:15.0.0-0ubuntu1vulnerable
Ubuntucinder20.042:16.0.0~b2~git2020020407.819b4a0fc-0ubuntu1vulnerable
Ubuntucinder20.042:16.0.0~b3~git2020032414.a0c0a9e23-0ubuntu1vulnerable
Ubuntucinder20.042:16.0.0~b3~git2020041012.eb915e2db-0ubuntu1vulnerable
Ubuntucinder20.042:16.0.0-0ubuntu0.20.04.1vulnerable
Ubuntucinder20.042:16.1.0-0ubuntu1vulnerable
Ubuntucinder20.042:16.2.0-0ubuntu1vulnerable
Ubuntucinder20.042:16.2.1-0ubuntu1vulnerable
Ubuntucinder20.042:16.2.1-0ubuntu2vulnerable
Ubuntucinder20.042:16.3.0-0ubuntu1vulnerable
Ubuntucinder20.042:16.4.0-0ubuntu1vulnerable
Ubuntucinder20.042:16.4.1-0ubuntu1vulnerable
Ubuntucinder20.042:16.4.2-0ubuntu2vulnerable
Ubuntucinder20.042:16.4.2-0ubuntu2.1vulnerable
Ubuntucinder20.042:16.4.2-0ubuntu2.2vulnerable
Ubuntucinder20.042:16.4.2-0ubuntu2.3vulnerable
Ubuntucinder20.042:16.4.2-0ubuntu2.4vulnerable
Ubuntucinder20.042:16.4.2-0ubuntu2.5vulnerable
Ubuntucinder20.042:16.4.2-0ubuntu2.6vulnerable
Ubuntucinder20.042:16.4.2-0ubuntu2.8vulnerable
Ubuntucinder20.042:16.4.2-0ubuntu2.9vulnerable
Ubuntucinder22.042:19.0.0-0ubuntu2vulnerable
Ubuntucinder22.042:19.0.0+git2022030310.b49fb59a6-0ubuntu1vulnerable
Ubuntucinder22.042:19.0.0+git2022030310.b49fb59a6-0ubuntu2vulnerable
Ubuntucinder22.042:20.0.0-0ubuntu1vulnerable
Ubuntucinder22.042:20.0.1-0ubuntu1vulnerable
Ubuntucinder22.042:20.1.0-0ubuntu1vulnerable
Ubuntucinder22.042:20.1.0-0ubuntu2.1vulnerable
Ubuntucinder22.042:20.1.0-0ubuntu2.2vulnerable
Ubuntucinder22.042:20.2.0-0ubuntu1vulnerable
Ubuntucinder22.042:20.2.0-0ubuntu1.1vulnerable
Ubuntucinder22.042:20.3.0-0ubuntu1vulnerable
Ubuntucinder22.042:20.3.1-0ubuntu1vulnerable
Ubuntucinder22.042:20.3.1-0ubuntu1.1vulnerable
Ubuntucinder22.042:20.3.1-0ubuntu1.2vulnerable
Ubuntucinder22.042:20.3.1-0ubuntu1.4vulnerable
Ubuntucinder22.042:20.3.1-0ubuntu1.5vulnerable
Ubuntucinder22.042:20.3.1-0ubuntu1.6vulnerable
Ubuntucinder24.042:23.0.0-0ubuntu1vulnerable
Ubuntucinder24.042:23.0.0-0ubuntu3vulnerable
Ubuntucinder24.042:23.0.0+git2024011915.b8cd101f-0ubuntu1vulnerable
Ubuntucinder24.042:23.0.0+git2024011915.b8cd101f-0ubuntu2vulnerable
Ubuntucinder24.042:24.0.0~rc1-0ubuntu1vulnerable
Ubuntucinder24.042:24.0.0-0ubuntu1vulnerable
Ubuntucinder24.042:24.0.0-0ubuntu1.2vulnerable
Ubuntucinder24.042:24.0.0-0ubuntu1.3vulnerable
Ubuntucinder24.042:24.2.0-0ubuntu1vulnerable
Ubuntucinder24.042:24.2.0-0ubuntu2vulnerable
Ubuntucinder24.042:24.2.0-0ubuntu2.1vulnerable
Ubuntucinder26.102:28.0.0-0ubuntu1vulnerable
Ubuntucinder26.102:28.0.0+git20260815.248.2a29bac-0ubuntu1vulnerable
Ubuntucinder26.102:29.0.0~rc1-0ubuntu1vulnerable
Ubuntucinder26.102:29.0.0-0ubuntu1vulnerable
Ubuntucinder26.042:27.0.0-0ubuntu1vulnerable
Ubuntucinder26.042:28.0.0~rc1-0ubuntu2vulnerable
Ubuntucinder26.042:28.0.0-0ubuntu1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiancindersourcesid2:29.0.0-3not yet assignedNot reported[1151437]
Debiancindersourceforky(unfixed)not yet assignedNot reported[1151437]
Debiancindersourcetrixie(unfixed)not yet assignedNot reported[1151437]
Debiancindersourcebookworm(unfixed)not yet assignedNot reported[1151437]

[Debian bug #1151437]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [cinder-api]Affected

    Source package: [cinder]

    Details (4)

    • 2:21.3.1-1~deb12u1 · all · bookworm

      Affected

      dsa · cinder · debian · bookworm; dsa · cinder · debian · 12

    • 2:21.3.1-1~deb12u1 · all · bookworm

      Affected

      dsa · cinder · debian · bookworm; dsa · cinder · debian · 12

    • 2:21.3.1-1~deb12u1 · all · bookworm-security

      Affected

      dsa · cinder · debian · bookworm; dsa · cinder · debian · 12

    • 2:21.3.1-1~deb12u1 · all · bookworm-security

      Affected

      dsa · cinder · debian · bookworm; dsa · cinder · debian · 12

  • [cinder-backup]Affected

    Source package: [cinder]

    Details (4)

    • 2:21.3.1-1~deb12u1 · all · bookworm

      Affected

      dsa · cinder · debian · bookworm; dsa · cinder · debian · 12

    • 2:21.3.1-1~deb12u1 · all · bookworm

      Affected

      dsa · cinder · debian · bookworm; dsa · cinder · debian · 12

    • 2:21.3.1-1~deb12u1 · all · bookworm-security

      Affected

      dsa · cinder · debian · bookworm; dsa · cinder · debian · 12

    • 2:21.3.1-1~deb12u1 · all · bookworm-security

      Affected

      dsa · cinder · debian · bookworm; dsa · cinder · debian · 12

  • [cinder-common]Affected

    Source package: [cinder]

    Details (4)

    • 2:21.3.1-1~deb12u1 · all · bookworm

      Affected

      dsa · cinder · debian · bookworm; dsa · cinder · debian · 12

    • 2:21.3.1-1~deb12u1 · all · bookworm

      Affected

      dsa · cinder · debian · bookworm; dsa · cinder · debian · 12

    • 2:21.3.1-1~deb12u1 · all · bookworm-security

      Affected

      dsa · cinder · debian · bookworm; dsa · cinder · debian · 12

    • 2:21.3.1-1~deb12u1 · all · bookworm-security

      Affected

      dsa · cinder · debian · bookworm; dsa · cinder · debian · 12

  • [cinder-doc]Affected

    Source package: [cinder]

    Details (4)

    • 2:21.3.1-1~deb12u1 · all · bookworm

      Affected

      dsa · cinder · debian · bookworm; dsa · cinder · debian · 12

    • 2:21.3.1-1~deb12u1 · all · bookworm

      Affected

      dsa · cinder · debian · bookworm; dsa · cinder · debian · 12

    • 2:21.3.1-1~deb12u1 · all · bookworm-security

      Affected

      dsa · cinder · debian · bookworm; dsa · cinder · debian · 12

    • 2:21.3.1-1~deb12u1 · all · bookworm-security

      Affected

      dsa · cinder · debian · bookworm; dsa · cinder · debian · 12

  • [cinder-scheduler]Affected

    Source package: [cinder]

    Details (4)

    • 2:21.3.1-1~deb12u1 · all · bookworm

      Affected

      dsa · cinder · debian · bookworm; dsa · cinder · debian · 12

    • 2:21.3.1-1~deb12u1 · all · bookworm

      Affected

      dsa · cinder · debian · bookworm; dsa · cinder · debian · 12

    • 2:21.3.1-1~deb12u1 · all · bookworm-security

      Affected

      dsa · cinder · debian · bookworm; dsa · cinder · debian · 12

    • 2:21.3.1-1~deb12u1 · all · bookworm-security

      Affected

      dsa · cinder · debian · bookworm; dsa · cinder · debian · 12

  • [cinder-volume]Affected

    Source package: [cinder]

    Details (4)

    • 2:21.3.1-1~deb12u1 · all · bookworm

      Affected

      dsa · cinder · debian · bookworm; dsa · cinder · debian · 12

    • 2:21.3.1-1~deb12u1 · all · bookworm

      Affected

      dsa · cinder · debian · bookworm; dsa · cinder · debian · 12

    • 2:21.3.1-1~deb12u1 · all · bookworm-security

      Affected

      dsa · cinder · debian · bookworm; dsa · cinder · debian · 12

    • 2:21.3.1-1~deb12u1 · all · bookworm-security

      Affected

      dsa · cinder · debian · bookworm; dsa · cinder · debian · 12

  • [python3-cinder]Affected

    Source package: [cinder]

    Details (4)

    • 2:21.3.1-1~deb12u1 · all · bookworm

      Affected

      dsa · cinder · debian · bookworm; dsa · cinder · debian · 12

    • 2:21.3.1-1~deb12u1 · all · bookworm

      Affected

      dsa · cinder · debian · bookworm; dsa · cinder · debian · 12

    • 2:21.3.1-1~deb12u1 · all · bookworm-security

      Affected

      dsa · cinder · debian · bookworm; dsa · cinder · debian · 12

    • 2:21.3.1-1~deb12u1 · all · bookworm-security

      Affected

      dsa · cinder · debian · bookworm; dsa · cinder · debian · 12

[Debian 13 (Trixie)]

  • [cinder-api]Affected

    Source package: [cinder]

    Details (2)

    • 2:26.0.0-2 · all · trixie

      Affected

      dsa · cinder · debian · 13

    • 2:26.0.0-2 · all · trixie

      Affected

      dsa · cinder · debian · 13

  • [cinder-backup]Affected

    Source package: [cinder]

    Details (2)

    • 2:26.0.0-2 · all · trixie

      Affected

      dsa · cinder · debian · 13

    • 2:26.0.0-2 · all · trixie

      Affected

      dsa · cinder · debian · 13

  • [cinder-common]Affected

    Source package: [cinder]

    Details (2)

    • 2:26.0.0-2 · all · trixie

      Affected

      dsa · cinder · debian · 13

    • 2:26.0.0-2 · all · trixie

      Affected

      dsa · cinder · debian · 13

  • [cinder-doc]Affected

    Source package: [cinder]

    Details (2)

    • 2:26.0.0-2 · all · trixie

      Affected

      dsa · cinder · debian · 13

    • 2:26.0.0-2 · all · trixie

      Affected

      dsa · cinder · debian · 13

  • [cinder-scheduler]Affected

    Source package: [cinder]

    Details (2)

    • 2:26.0.0-2 · all · trixie

      Affected

      dsa · cinder · debian · 13

    • 2:26.0.0-2 · all · trixie

      Affected

      dsa · cinder · debian · 13

  • [cinder-volume]Affected

    Source package: [cinder]

    Details (2)

    • 2:26.0.0-2 · all · trixie

      Affected

      dsa · cinder · debian · 13

    • 2:26.0.0-2 · all · trixie

      Affected

      dsa · cinder · debian · 13

  • [python3-cinder]Affected

    Source package: [cinder]

    Details (2)

    • 2:26.0.0-2 · all · trixie

      Affected

      dsa · cinder · debian · 13

    • 2:26.0.0-2 · all · trixie

      Affected

      dsa · cinder · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]