CVE-2026-93856 OpenStack CVE debrief

Who should care

Defenders managing OpenStack Cinder deployments, especially those with non-admin users having project-scoped 'member' or 'reader' roles, should assess exposure and prioritize verification.

Why it matters

CVE-2026-93856 is a medium-severity vulnerability in OpenStack Cinder that allows cross-project information disclosure through the Messages API. Defenders should prioritize verifying exposure, especially in deployments with non-admin users having project-scoped roles, and restrict access to the affected API call.

• Disclosure of UUIDs of resources owned by other projects
• Potential leakage of user messages about other projects' resources
• Verification of access controls for the Block Storage API v3.3 'List messages' call
• Prioritization of OpenStack Cinder deployment security assessments

Technical summary

In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API. A non-admin user with the project-scoped 'member' or 'reader' role making the Block Storage API v3.3 'List messages' call finds the non-expired user messages for other projects included in the response, resulting in the leakage of UUIDs of resources owned by other projects, in addition to the user message about the other projects' resources (which, by design, are sanitized generic messages). All Cinder deployments are affected. Defenders should prioritize verifying exposure in OpenStack Cinder deployments, especially those with non-admin users having project-scoped 'member' or 'reader' roles.

Defensive priority

Defenders should prioritize verifying exposure in OpenStack Cinder deployments, especially those with non-admin users having project-scoped 'member' or 'reader' roles.

Recommended defensive actions

• Verify OpenStack Cinder deployments for exposure, especially those with non-admin users having project-scoped 'member' or 'reader' roles.
• Restrict access to the Block Storage API v3.3 'List messages' call to prevent cross-project information disclosure.
• Monitor for and track messages related to resources owned by other projects.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and OpenStack Cinder source details indicate cross-project information disclosure in the Messages API, allowing non-admin users to find non-expired user messages for other projects. Evidence is limited to CVE and source-item details. Defenders should verify OpenStack Cinder deployments for exposure, especially those with non-admin users having project-scoped 'member' or 'reader' roles, and restrict access to the affected API call to prevent cross-project information disclosure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.