Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-93854

Quick assessment

Affected
OpenStack Blazar
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 OpenStack Blazar 17.0.1 版本之前，V2 租约（lease）API 在其更新和删除操作（ 和 ）中，未强制执行对象级别的授权检查。 政策授权（policy authorize）包装器本应加载目标租约，并根据其所有者构建授权目标；但该包装器使用关键字 来查找租约，而控制器方法中该参数名为 （且 包装器以位置参数方式传递）。由于关键字不匹配，查找结果为 ，导致授权逻辑回退到请求用户的自身 / ，而非目标租约的所有者。 因此，任何知道某个租约 ID 的已认证用户，都可以修改或删除属于其他用户或项

CVSS 7.2 · High

Possible ATT&CK Techniques 1 AI

T1210 · Exploitation of Remote Services

Affected Version Matrix 3

VendorProduct Version RangeStatus
OpenStack Blazar 1.0.0< 15.1.1 affected
16.0.0< 16.0.1 affected
17.0.0< 17.0.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-93854

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce object-level authorization on its update and delete operations (PUT /v2/leases/{lease_id} and DELETE /v2/leases/{lease_id}). The policy authorize() wrapper attempts to load the target lease to build the authorization target from its owner, but it looks up the lease under the keyword "lease_id" whereas the controller methods name the parameter "id" (and the wsme_pecan.wsexpose wrapper delivers it positionally). The lookup returns None, and thus authorization falls back to the requesting user's own project_id/user_id instead of the target lease owner. Any authenticated user who knows a lease ID can therefore modify or delete leases belonging to other users and projects, bypassing the intended ownership check.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用错误要素进行比较
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
OpenStack Blazar 1.0.0 ~ 15.1.1 -

II. Public POCs for CVE-2026-93854

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-93854

请登录查看更多情报信息。

Other References for CVE-2026-93854 (1)

IV. Related Vulnerabilities

Same product: Blazar
Same vendor: OpenStack
Same weakness: CWE-1025

V. Comments for CVE-2026-93854

No comments yet

Leave a comment