#1151437 CVE-2026-93856 / OSSA-2026-045: Cross-project information disclosure in Cinder Messages API #1151437
- Package:
- src:cinder
- Source:
- src:cinder
- Submitter:
- Thomas Goirand
- Date:
- 2026-10-20 19:37:02 UTC
- Severity:
- normal
- Tags:
As per upstream announce at: https://security.openstack.org/ossa/OSSA-2026-045.html Date: October 20, 2026 CVE: CVE-2026-93856 Affects ~~~~~~~ - Cinder: >=9.0.0 <26.3.1, ==27.0.0, ==28.0.0, ==29.0.0 Description ~~~~~~~~~~~ Yuliang Xiao, an independent reporter, and Chen YuXiang of the Institute of Computing Technology, Chinese Academy of Sciences independently reported a vulnerability in Cinder's messages API. A non-admin user with the project-scoped 'member' or 'reader' role making the Block Storage API v3.3 "List messages" call finds the non-expired user messages for other projects included in the response, resulting in the leakage of UUIDs of resources owned by other projects in addition to the user message about the other projects' resources (which, by design, are sanitized generic messages). All Cinder deployments are affected. Patches ~~~~~~~ - https://review.opendev.org/1011490 (2025.1/epoxy) - https://review.opendev.org/1011489 (2025.2/flamingo) - https://review.opendev.org/1011488 (2026.1/gazpacho) - https://review.opendev.org/1011487 (2026.2/hibiscus) - https://review.opendev.org/1011486 (2027.1/indri (development)) Credits ~~~~~~~ - Yuliang Xiao (CVE-2026-93856) - Chen YuXiang from Institute of Computing Technology, Chinese Academy of Sciences (CVE-2026-93856) References ~~~~~~~~~~ - https://launchpad.net/bugs/2160671 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93856 Notes ~~~~~ - Although the UUIDs of resources of other projects are leaked, a project_id is not included in the response, so someone wishing to exploit the leak must find an independent means of correlating each resource ID with its associated project. - The user messages API was introduced during the Newton development cycle and first appeared in Cinder 9.0.0. - The Cinder Contributor Guide contains more information about User Messages: https://docs.openstack.org/cinder/latest/contributor/user_messages.html - Cinder user messages are controlled by the configuration options ``message_ttl`` (default: 30 days) and ``message_reap_interval`` (default: 24 hours).
Hello, Bug #1151437 in cinder reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/cinder/-/commit/da0987990f1b22be15ed93e4db3f15993581151f ------------------------------------------------------------------------ * CVE-2026-93856 / OSSA-2026-045: Cross-project information disclosure in the Cinder Messages API. Applied upstream patch "Fix cross-project information disclosure in the messages API" (Closes: #1151437): - CVE-2026-93856_Fix_cross-project-info-disclosure-in-messages-API.patch ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1151437
Hello, Bug #1151437 in cinder reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/cinder/-/commit/d3ecfb14aa9d3956ccd4643dbd0d2ca376abd038 ------------------------------------------------------------------------ * CVE-2026-93856 / OSSA-2026-045: Cross-project information disclosure in the Cinder Messages API. Applied upstream patch "Fix cross-project information disclosure in the messages API" (Closes: #1151437): - CVE-2026-93856_Fix_cross-project-info-disclosure-in-messages-API.patch ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1151437
Hello, Bug #1151437 in cinder reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/cinder/-/commit/8ce3f0d9dda9e2b544c31679a3d16d4e4e4f07cb ------------------------------------------------------------------------ * CVE-2026-93856 / OSSA-2026-045: Cross-project information disclosure in the Cinder Messages API. Applied upstream patch "Fix cross-project information disclosure in the messages API" (Closes: #1151437): - CVE-2026-93856_Fix_cross-project-info-disclosure-in-messages-API.patch ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1151437
Hello, Bug #1151437 in cinder reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/cinder/-/commit/9ab236e5ac442031a4fcee24c8f701e661f06edc ------------------------------------------------------------------------ * CVE-2026-93856 / OSSA-2026-045: Cross-project information disclosure in the Cinder Messages API. Applied upstream patch "Fix cross-project information disclosure in the messages API" (Closes: #1151437): - CVE-2026-93856_Fix_cross-project-info-disclosure-in-messages-API.patch ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1151437
Hello, Bug #1151437 in cinder reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/cinder/-/commit/32ed7f6a4b6199ade0ee267856643f85279aa2c5 ------------------------------------------------------------------------ * CVE-2026-93856 / OSSA-2026-045: Cross-project information disclosure in the Cinder Messages API. Applied upstream patch "Fix cross-project information disclosure in the messages API" (Closes: #1151437): - CVE-2026-93856_Fix_cross-project-info-disclosure-in-messages-API.patch ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1151437
Hello, Bug #1151437 in cinder reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/cinder/-/commit/0d1464ecbc431ffabe9b0a65eaa9a1d62569cb8d ------------------------------------------------------------------------ * CVE-2026-93856 / OSSA-2026-045: Cross-project information disclosure in the Cinder Messages API. Applied upstream patch "Fix cross-project information disclosure in the messages API" (Closes: #1151437): - CVE-2026-93856_Fix_cross-project-info-disclosure-in-messages-API.patch ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1151437
Hello, Bug #1151437 in cinder reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/cinder/-/commit/2bd7d99966940b04fda09e4d15c740e76a181bb9 ------------------------------------------------------------------------ * CVE-2026-93856 / OSSA-2026-045: Cross-project information disclosure in the Cinder Messages API. Applied upstream patch "Fix cross-project information disclosure in the messages API" (Closes: #1151437): - CVE-2026-93856_Fix_cross-project-info-disclosure-in-messages-API.patch ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1151437
Hello, Bug #1151437 in cinder reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/cinder/-/commit/4dbb3258ba86f5e11332335e4b0a33605d9fbe64 ------------------------------------------------------------------------ * CVE-2026-93856 / OSSA-2026-045: Cross-project information disclosure in the Cinder Messages API. Applied upstream patch "Fix cross-project information disclosure in the messages API" (Closes: #1151437): - CVE-2026-93856_Fix_cross-project-info-disclosure-in-messages-API.patch ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1151437
We believe that the bug you reported is fixed in the latest version of
cinder, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 1151437@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Thomas Goirand <zigo@debian.org> (supplier of updated cinder package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 20 Oct 2026 20:04:15 +0200
Source: cinder
Architecture: source
Version: 2:29.0.0-3
Distribution: unstable
Urgency: high
Maintainer: Debian OpenStack <team+openstack@tracker.debian.org>
Changed-By: Thomas Goirand <zigo@debian.org>
Closes: 1151437
Changes:
cinder (2:29.0.0-3) unstable; urgency=high
.
* CVE-2026-93856 / OSSA-2026-045: Cross-project information disclosure
in the Cinder Messages API. Applied upstream patch "Fix cross-project
information disclosure in the messages API" (Closes: #1151437):
- CVE-2026-93856_Fix_cross-project-info-disclosure-in-messages-API.patch
Checksums-Sha1:
599e88cae4e41f452e3394ef89fb019aa60d41c3 4287 cinder_29.0.0-3.dsc
9b1f3a1b404a912b496f09be3a651ea77547bb46 48448 cinder_29.0.0-3.debian.tar.xz
03437760a06ecf90ba4730f1e6921d1d5ad78ff2 20383 cinder_29.0.0-3_amd64.buildinfo
Checksums-Sha256:
47a378ffcd45ba2efebc3800f90b1c11262efc2d4c99028e0c93e0208cb3aa21 4287 cinder_29.0.0-3.dsc
e2724ac775b7c985460d376ec6c04d12693fe631d59e639b2939ff4cd05613b7 48448 cinder_29.0.0-3.debian.tar.xz
b5e92879f62d73b599c7655a568fcb98b0533282fc4a4b8a979f527cb43c1c3f 20383 cinder_29.0.0-3_amd64.buildinfo
Files:
1e3bab5f39e8c5e20a89428e65edd2eb 4287 net optional cinder_29.0.0-3.dsc
e8e845d22f9f537d64cbefe687543a52 48448 net optional cinder_29.0.0-3.debian.tar.xz
895a4481560fec2d36bb32e133810a66 20383 net optional cinder_29.0.0-3_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmrXvt0ACgkQ1BatFaxr
Q/7a3g/7BXZyHXwicNFFFHMrKWyjP3udfQJad1SkDpuv9vJWbc35lCaJDKqIzguQ
atf+g3fWSOcF8a8MogIQ/PNM0D3ciAmQBKpdk+pHiKM6I1FZNVB4cbzRKJJsKFg3
4yrPCev3mfNUkDb+FdA9tCbWFJvygju1QRlUfevo/RKn2B2Px180pQA+lAlMa3Lh
gTb4z8H9SM/AWw7PlDCVvbD87rdQvrGjR/VjE/S2bEhQm0+Ty/gNN3uK834pgFSj
NROCYvTC6z5GrcYB9Ow0lZNAcMJBGpmBuSvqZ5swO3B65Mb+wnovZ8pDIWek+jsM
Nq6vxrWY3PHLTtZkrxLCp2S/vFlzWFGloyHcynjdxXIbZKdOVwxxQHWFz7tjjaoR
RfJ4RUmaBaZwwpGweBgqDoFFI7TwffBKlVsxPQ6jMiYHEkNuyM5OkfajD56NQQx5
Njy3+dgYnNoGoNVihuwTCw/GvLIA3aR3edM76e9ASHXo+zMR+9oQBW0YFp7JMsJh
RWnUBYYkBTYL55iXx5iQaH6Xdx9LaLPLWsAzPc/yARNHciGGRvLdhpfD+8EmlI1s
X27qEKqV2cLhyJrxVzDzvL9JqGfpPSZM/wufNTLG3fCmZO+zyVZLaxVyLsqg6oBY
kizkG/6lnePdAPvZKeTP1Mi3YTGZkUJl38TvXJx0efjb0EqSk5c=
=t5EU
-----END PGP SIGNATURE-----