OpenStack Manila Critical Flaw Lets Users Hijack Public Shares
A critical authorization flaw in OpenStack Manila allows authenticated users to modify, back up, or delete public file shares belonging to other projects.
Key points
- CVE-2026-71195 allows cross-project manipulation of public shares in OpenStack Manila.
- Attackers can exfiltrate data via backups or revoke owner access rules.
- Fixes are available in versions 20.0.3, 21.0.3, 22.0.2, and 23.0.1.
A critical authorization vulnerability in OpenStack Manila permits authenticated users to manipulate public file shares owned by other projects, according to an advisory published on October 20, 2026. The flaw, tracked as CVE-2026-71195, affects multiple API operations that fail to verify share ownership before executing commands.
At a glance
- CVE
- CVE-2026-71195
- Product
- OpenStack Manila
- CVSS
- 9.9 Critical
- Weakness
- incorrect authorization
- Exploited
- No known exploitation
The OpenStack Security Advisory (OSSA-2026-046) details how the Manila API controllers authorize operations against the caller's project context but load foreign public shares without re-authorizing against the actual owner. This logic error allows any project member to exploit these operations on any public share, as the share UUID is visible to all users.
Scope of the Vulnerability
The National Vulnerability Database rates the flaw as critical with a CVSS score of 9.9, citing CWE-863 for incorrect authorization. The vulnerability enables attackers to grant or revoke data-plane access, escalate permissions from read-only to read-write, and create backups that exfiltrate share data under the attacker's project.
Attackers can also soft-delete foreign shares, move them to the recycle bin, or restore them to interfere with deletion workflows. Additionally, the flaw allows the creation, update, and deletion of metadata on foreign export locations, further compromising the integrity of shared storage resources.
Affected Versions and Background
Chen YuXiang disclosed the vulnerability to the OpenStack community, leading to the release of fixes for affected versions. The flaw impacts Manila versions 1.0.0 through 20.0.2, 21.0.0 through 21.0.2, 22.0.0 through 22.0.1, and version 23.0.0. Users running these versions are urged to update immediately.
The advisory notes that the issue stems from the API's failure to re-authorize actions against the share's actual owner after loading a foreign public share. This allows attackers to perform sensitive operations such as listing access rules, which can disclose IPs, usernames, and CephFS keys associated with the share.
What should you do?
Administrators should verify their current Manila version and apply the latest security patches if they are running an affected release. Organizations using public shares should audit access logs for unusual activity, such as unexpected backup creations or access rule modifications.
What to do and how to stay safe
- Check your OpenStack Manila version against the affected list in the advisory.
- Apply the latest security update once the vendor provides an update for your version.
- Monitor API logs for unauthorized access rule changes or backup creations on public shares.
- Review export location metadata for unexpected modifications or deletions.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
