As cited
Copy frozen at (site build).
vulnerabilities
[OSSA-2026-045] Cinder: Cross-project information disclosure in Cinder Messages API (CVE-2026-93856)
OpenStack Cinder versions 9.0.0 through 26.3.1 and versions 27.0.0, 28.0.0, and 29.0.0 contain a cross-project information disclosure vulnerability in the Messages application programming interface (API). The flaw, identified as CVE-2026-93856, allows unauthorized access to sensitive data across project boundaries.
Why it matters: Organizations running affected Cinder versions should immediately assess exposure and apply patches or upgrade to a patched release to prevent unauthorized disclosure of block storage management information across tenants.
- Source published
- First seen by Cybersecurity Tracker