Key points
- CVE-2026-71195 allows cross-project manipulation of public shares in OpenStack Manila.
- Attackers can create backups, change access levels or delete shares they do not own.
- Versions before 20.0.3, 21.0.3, 22.0.2 and 23.0.1 are affected by this critical flaw.
An authenticated user can now take control of public file shares belonging to other projects in OpenStack Manila. This vulnerability, identified as CVE-2026-71195, permits attackers to modify access permissions, create unauthorized backups and even delete shares without the owner’s consent. The issue arises because the system fails to verify ownership when processing certain API requests on public shares.
In plain English
The flaw exists because Manila checks if a user belongs to a project but does not confirm they own the specific share being targeted. Since the share is public, its unique identifier is visible to anyone. An attacker can use this ID to send commands that the system accepts, assuming the user has rights because they are authenticated within the platform, regardless of actual share ownership.
The background
According to the National Vulnerability Database, this issue affects OpenStack Manila versions prior to 23.0.1. Specific vulnerable ranges include versions before 20.0.3, before 21.0.3 and before 22.0.2. The advisory notes that Chen YuXiang disclosed the vulnerability, which carries a CVSS score of 9.9, rating it as critical. It stems from a lack of proper authorisation checks in API controllers.
What changes now
Operators must assess whether their Manila installations fall within the affected version ranges. If so, they face significant risk of data theft or service disruption. The vulnerability allows for data exfiltration via backup creation and potential denial of service through share deletion. Immediate attention is required for any environment hosting public shares that contain sensitive or proprietary information.
The attacker's path
Teams usually review API authorisation logic to ensure ownership checks occur at the resource level, not just the project level. Check whether your infrastructure validates resource IDs against user permissions before executing state-changing operations. Monitor for unusual backup creation or access rule modifications on public assets. Ensure that public visibility does not bypass mandatory ownership verification in your storage orchestration tools.
What to do and how to stay safe: OpenStack
- Audit all public share configurations to identify those accessible by non-owner accounts.
- Review API logs for unexpected access rule changes or backup creations from unknown users.
- Upgrade OpenStack Manila to version 23.0.1 or later once the vendor provides an update.
- Restrict public share usage to non-sensitive data until patches are applied.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of OpenStack Manila are affected?
Versions before 20.0.3, before 21.0.3, before 22.0.2 and before 23.0.1 are vulnerable.
What is the severity of CVE-2026-71195?
The National Vulnerability Database rates it as critical with a CVSS score of 9.9.
Can an attacker steal data using this flaw?
Yes, attackers can create backups of foreign shares under their own project to exfiltrate data.
