OpenStack Manila up to 20.0.2/21.0.2/22.0.1/23.0.0 privileges management

Summaryinfo

A vulnerability marked as very critical has been reported in OpenStack Manila up to 20.0.2/21.0.2/22.0.1/23.0.0. Affected by this issue is some unknown functionality. Performing a manipulation results in privileges management. This vulnerability is identified as CVE-2026-71195. The attack can be initiated remotely. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in OpenStack Manila up to 20.0.2/21.0.2/22.0.1/23.0.0. It has been classified as very critical. This affects an unknown code. The manipulation with an unknown input leads to a privileges management vulnerability. CWE is classifying the issue as CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize operations against the caller's own project context, then load a foreign public share without re-authorizing against the share's actual owner. This affects the following operations: allow_access: grant data-plane read/write access to another tenant's share; deny_access: revoke the owner's existing access rules; update_access: escalate access level (e.g., ro to rw); create_share_backup: exfiltrate share data via a backup created under the attacker's project; soft_delete: move a foreign share to the recycle bin; restore: interfere with the owner's deletion workflow; export location metadata: create, update, and delete metadata on foreign export locations; access rule listing: disclose IPs, usernames, and CephFS keys. Any authenticated project member can exploit these operations on any public share. The share UUID is visible since the share is public.

It is possible to read the advisory at launchpad.net. This vulnerability is uniquely identified as CVE-2026-71195 since 08/05/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/21/2026). The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

Upgrading to version 20.0.3, 21.0.3, 22.0.2 or 23.0.1 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Cloud Software

Vendor

• OpenStack

Name

• Manila

Version

• 20.0.0
• 20.0.1
• 20.0.2
• 21.0.0
• 21.0.1
• 21.0.2
• 22.0.0
• 22.0.1
• 23.0

License

• free

Website

• Vendor: https://www.openstack.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion