Openstack Blazar vulnerabilities

2 CVEs affecting Openstack Blazar, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-93854, published 2026-09-18.

More from Openstack.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-93854, published 2026-09-18. High severity, CVSS 7.2. EPSS: 0.4% chance of exploitation in the next 30 days. In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce object-level authorization on its update and delete operations (PUT /v2/leases/{lease_id} and DELETE /v2/leases/{lease_id}). The…
• CVE-2026-93852, published 2026-09-18. High severity, CVSS 7.1. EPSS: 0.4% chance of exploitation in the next 30 days. In OpenStack Blazar before 17.0.1, the V2 lease listing operation (GET /v2/leases) returns leases for every project without enforcing project scoping or an administrator-only policy. Any…