#1151439 CVE-2026-71195 / OSSA-2026-046: Manila allows cross-project public-share and export-metadata changes #1151439
- Package:
- src:manila
- Source:
- src:manila
- Submitter:
- Thomas Goirand
- Date:
- 2026-10-20 21:09:02 UTC
- Severity:
- normal
- Tags:
As per upstream announce here: https://security.openstack.org/ossa/OSSA-2026-046.html Date: October 20, 2026 :CVE: CVE-2026-71195 Affects ~~~~~~~ - Manila: >=1.0.0 <20.0.3, >=21.0.0 <21.0.3, >=22.0.0 <22.0.2, ==23.0.0 Description ~~~~~~~~~~~ Chen YuXiang from the Institute of Computing Technology, Chinese Academy of Sciences reported that a non-owner could modify access rules and export-location metadata of another project's public share. Goutham Pacha Ravi and Carlos da Silva from Red Hat identified further public-share paths: a non-owner could soft-delete or restore a foreign public share, or create a backup of it. A compatible storage backend may apply unauthorized changes to existing access rules, disrupting access for the share's owner or authorized users. Separately, Yuliang Xiao reported that the export-location metadata API does not scope its lookup to the share in the request. An authenticated project member may therefore read, modify, or delete another project's export-location metadata by supplying the target export-location UUID with the identifier of a share they control. This issue is more easily exploitable with public shares. Deployments with public shares are affected by the public-share operations. Deployments that utilize export-location metadata for shares are affected by the metadata vulnerability. Patches ~~~~~~~ - https://review.opendev.org/1011483 (2025.1/epoxy) - https://review.opendev.org/1011482 (2025.2/flamingo) - https://review.opendev.org/1011481 (2026.1/gazpacho) - https://review.opendev.org/1011479 (2026.2/hibiscus) - https://review.opendev.org/1011478 (2027.1/indri (development)) Credits ~~~~~~~ - Chen YuXiang from Institute of Computing Technology, Chinese Academy of Sciences (CVE-2026-71195) - Yuliang Xiao (CVE-2026-71195) References ~~~~~~~~~~ - https://bugs.launchpad.net/manila/+bug/2161412 - https://bugs.launchpad.net/manila/+bug/2168962 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-71195 Notes ~~~~~ - The companion Manila Tempest plugin update, https://review.opendev.org/1011484, updates cross-project export- location tests to expect 404 after the fix.
Hello, Bug #1151439 in manila reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/manila/-/commit/2d6729cff1b1dc9269101e194da3fc646154c096 ------------------------------------------------------------------------ * CVE-2026-71195 / OSSA-2026-046: Manila allows cross-project public-share and export-metadata changes. Applied upstream patch "Fix policy control for public shares" (Closes: #1151439): - CVE-2026-71195_Fix_policy_control_for_public_shares.patch ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1151439
Hello, Bug #1151439 in manila reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/manila/-/commit/fd67341d62d4a2db969ca461e1a8c6dc46b0b965 ------------------------------------------------------------------------ * CVE-2026-71195 / OSSA-2026-046: Manila allows cross-project public-share and export-metadata changes. Applied upstream patch "Fix policy control for public shares" (Closes: #1151439): - CVE-2026-71195_Fix_policy_control_for_public_shares.patch ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1151439
Hello, Bug #1151439 in manila reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/manila/-/commit/8d4a6e97919aa8d35ecc659dcc468c4a978fefc8 ------------------------------------------------------------------------ * CVE-2026-71195 / OSSA-2026-046: Manila allows cross-project public-share and export-metadata changes. Applied upstream patch "Fix policy control for public shares" (Closes: #1151439): - CVE-2026-71195_Fix_policy_control_for_public_shares.patch ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1151439
Hello, Bug #1151439 in manila reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/manila/-/commit/5d82db197e6827aa773f7128db65969cc25f8ef9 ------------------------------------------------------------------------ * CVE-2026-71195 / OSSA-2026-046: Manila allows cross-project public-share and export-metadata changes. Applied upstream patch "Fix policy control for public shares" (Closes: #1151439): - CVE-2026-71195_Fix_policy_control_for_public_shares.patch ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1151439
Hello, Bug #1151439 in manila reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/manila/-/commit/a26482df3d577fc5b38fd91a9fd59b3d1b817439 ------------------------------------------------------------------------ * CVE-2026-71195 / OSSA-2026-046: Manila allows cross-project public-share and export-metadata changes. Applied upstream patch "Fix policy control for public shares" (Closes: #1151439): - CVE-2026-71195_Fix_policy_control_for_public_shares.patch ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1151439
Hello, Bug #1151439 in manila reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/manila/-/commit/c2754db0011590a1629ced333dd826c899b1a4c6 ------------------------------------------------------------------------ * CVE-2026-71195 / OSSA-2026-046: Manila allows cross-project public-share and export-metadata changes. Applied upstream patch "Fix policy control for public shares" (Closes: #1151439): - CVE-2026-71195_Fix_policy_control_for_public_shares.patch ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1151439
Hello, Bug #1151439 in manila reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/manila/-/commit/8993ad88445f24626ebbfefacd759e35bd71d20b ------------------------------------------------------------------------ * CVE-2026-71195 / OSSA-2026-046: Manila allows cross-project public-share and export-metadata changes. Applied upstream patch "Fix policy control for public shares" (Closes: #1151439): - CVE-2026-71195_Fix_policy_control_for_public_shares.patch ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1151439
Hello, Bug #1151439 in manila reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/manila/-/commit/bfd4b4de69f8c8451cd7cc6a5fedf02f0e627002 ------------------------------------------------------------------------ * CVE-2026-71195 / OSSA-2026-046: Manila allows cross-project public-share and export-metadata changes. Applied upstream patch "Fix policy control for public shares" (Closes: #1151439): - CVE-2026-71195_Fix_policy_control_for_public_shares.patch ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1151439
Hello, Bug #1151439 in manila reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/manila/-/commit/36ce6cea285db5f42444d1facfd763f7383656ab ------------------------------------------------------------------------ * CVE-2026-71195 / OSSA-2026-046: Manila allows cross-project public-share and export-metadata changes. Applied upstream patch "Fix policy control for public shares" (Closes: #1151439): - CVE-2026-71195_Fix_policy_control_for_public_shares.patch ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1151439
We believe that the bug you reported is fixed in the latest version of
manila, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 1151439@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Thomas Goirand <zigo@debian.org> (supplier of updated manila package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 20 Oct 2026 22:36:10 +0200
Source: manila
Architecture: source
Version: 1:23.0.0-4
Distribution: unstable
Urgency: high
Maintainer: Debian OpenStack <team+openstack@tracker.debian.org>
Changed-By: Thomas Goirand <zigo@debian.org>
Closes: 1151439
Changes:
manila (1:23.0.0-4) unstable; urgency=high
.
* CVE-2026-71195 / OSSA-2026-046: Manila allows cross-project
public-share and export-metadata changes. Applied upstream patch
"Fix policy control for public shares" (Closes: #1151439):
- CVE-2026-71195_Fix_policy_control_for_public_shares.patch
Checksums-Sha1:
c3f19276b1fe446f9c489ea8f110b94d01cb1f8d 3794 manila_23.0.0-4.dsc
6c06b2da57ef22d89b8ed5ac0518f5f50721095d 20240 manila_23.0.0-4.debian.tar.xz
b7c5b247ea8f4b2d522d87811e610efee3898efb 16263 manila_23.0.0-4_amd64.buildinfo
Checksums-Sha256:
71de522412cc443b9b5a9a25ff587415bfe94e26faf5777c3e0dde5b79b55057 3794 manila_23.0.0-4.dsc
3befec713cd6a98cb9345fc6968974809d8ebed65dd53e47942dbebf341f7b40 20240 manila_23.0.0-4.debian.tar.xz
cdddb6867d98d098d6dd3d63f83ddd055bc7a0d67209d33109141ebdeb8bb792 16263 manila_23.0.0-4_amd64.buildinfo
Files:
bdb9df046d36efca02cb5ac8c2e946a6 3794 net optional manila_23.0.0-4.dsc
e7470fd42656ab09088e401157bb1f67 20240 net optional manila_23.0.0-4.debian.tar.xz
32bd3716de3ae34ca6c15b1bf6e3b4b5 16263 net optional manila_23.0.0-4_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmrX0gsACgkQ1BatFaxr
Q/4+FQ/+OzjwGKbMXirqa9sNzfit/obZMbPDW5JWZyWide4bgMrOdVkPNfBgxnVO
uD1t8xoNNNVS63/CgkfOYDijCcmbDd7Yl9h7Xd8223ykcbPyUjjgsk54g2n5tlBB
7s1I76/jXm8g3TNK/QJ++Keb8dlFw7m9Jsd+z7p8MXRCzMPnhvPAIpocZDX4dWZf
BSMr2rPoDIoB89dh7bMu4lgpxymO/EmF6NXNGXTmfEmX1YnO4cMmNLp7QDuFfguC
Gtlyf9ZGn0MhbtL/1C9pg/U7OopBR6+Y6djUpv3DC2vdJkpegJEnJUJGRzo4S3lh
qSTXr9nC2su4xScmYGW2lPru2BLU+V4bgP4QKzLFePbCC0+pTxJLKEDZVfkJ3Aqv
3LXrW01uVdYmujKgz+bU+f/FcswfSzHiWvqrI/+mw7wmJhSnHGHQFOUaHs4K3tXl
o4YUucxh9pR+cfAZVy2R05vuAk8CDjlKYF/1p0kPOu4/dnnKL3kqYISoAYEjHRnt
rgJLPDS9CZzeGY+oI60J/WaEgt7RlNUcE2Hs3Sz0EY/SvNAYaSdQLsMDEoAWGUZt
bV7VhBbpG4wSL5f+2JS1mpyMTOCAOUC5MkSLiunEPic3sNDQroybCV6CFXC9Dkl6
FVZzRlf/sgPOpnwErYvHkeZNHvEypu3mkJ6mjLywFdUCLEXx/8Y=
=Q/8w
-----END PGP SIGNATURE-----