Openstack Cyborg vulnerabilities

2 CVEs affecting Openstack Cyborg, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-40214, published 2026-05-07.

More from Openstack.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-40213, published 2026-05-07. High severity, CVSS 7.4. EPSS: 0.3% chance of exploitation in the next 30 days. OpenStack Cyborg before 16.0.1 uses rule:allow (check_str='@') as the default policy for multiple API endpoints. This unconditionally authorizes any request carrying a valid Keystone token regardless…
• CVE-2026-40214, published 2026-05-07. Medium severity, CVSS 6.3. EPSS: 0.3% chance of exploitation in the next 30 days. In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer. The project_id column in the database is never populated (NULL for every ARQ),…