Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN1060
_____________________________________________________________________

DATE                : 21/10/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Cinder versions prior to 26.3.1, 
                             ==27.0.0, ==28.0.0, ==29.0.0.

====================================================================
https://security.openstack.org/ossa/OSSA-2026-045.html
_____________________________________________________________________


OSSA-2026-045: Cross-project information disclosure in Cinder Messages
API

Date:

    October 20, 2026
CVE:

    CVE-2026-93856

Affects

    Cinder: >=9.0.0 <26.3.1, ==27.0.0, ==28.0.0, ==29.0.0

Description

Yuliang Xiao, an independent reporter, and Chen YuXiang of the Institute
of Computing Technology, Chinese Academy of Sciences independently
reported a vulnerability in Cinder’s messages API. A non-admin user with
the project-scoped ‘member’ or ‘reader’ role making the Block Storage API
v3.3 “List messages” call finds the non-expired user messages for other
projects included in the response, resulting in the leakage of UUIDs of
resources owned by other projects in addition to the user message about
the other projects’ resources (which, by design, are sanitized generic
messages). All Cinder deployments are affected.


Patches

    https://review.opendev.org/1011490 (2025.1/epoxy)

    https://review.opendev.org/1011489 (2025.2/flamingo)

    https://review.opendev.org/1011488 (2026.1/gazpacho)

    https://review.opendev.org/1011487 (2026.2/hibiscus)

    https://review.opendev.org/1011486 (2027.1/indri (development))


Credits

    Yuliang Xiao (CVE-2026-93856)

    Chen YuXiang from Institute of Computing Technology, Chinese Academy
of Sciences (CVE-2026-93856)

References

    https://launchpad.net/bugs/2160671

    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93856

Notes

    Although the UUIDs of resources of other projects are leaked, a
project_id is not included in the response, so someone wishing to exploit
the leak must find an independent means of correlating each resource ID
with its associated project.

    The user messages API was introduced during the Newton development
cycle and first appeared in Cinder 9.0.0.

    The Cinder Contributor Guide contains more information about User
Messages.

    Cinder user messages are controlled by the configuration options
message_ttl (default: 30 days) and message_reap_interval
(default: 24 hours).

=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================