Executive Intelligence Brief

A critical vulnerability, CVE-2026-71195, has been identified in OpenStack Manila, a widely-used open-source software for managing shared file systems in OpenStack clouds. This vulnerability has a CVSS score of 9.9, indicating a high severity level. It affects multiple versions of OpenStack Manila, specifically versions 1.0.0 to 22.0.2 and 23.0.0, prior to the patched version 23.0.1. The vulnerability allows any authenticated project member to perform unauthorized actions on public shares, including granting data-plane access, revoking access, escalating access levels, creating backups, soft-deleting shares, restoring shares, and manipulating export location metadata. Immediate patching to version 23.0.1 or later is strongly recommended to mitigate this vulnerability.

Threat Overview

OpenStack Manila is an open-source software project that provides a shared file system service for OpenStack, allowing users to create and manage shared file systems. It is a critical component in OpenStack deployments, providing persistent storage for virtual machines and applications. The vulnerability in OpenStack Manila affects multiple API operations related to public shares. Public shares are accessible to anyone with the share UUID, which is visible by design. The vulnerability arises because the API controllers authorize operations against the caller's project context but do not re-authorize against the share's actual owner when loading a foreign public share. This oversight allows an authenticated project member to exploit these operations on any public share, potentially leading to unauthorized data access, modification, or deletion.

Technical Deep Dive

Vulnerability Classification

The vulnerability is classified under CWE-863, which refers to 'Incorrect Authorization.' This class of vulnerability occurs when an application does not correctly verify the authorization of a user to perform certain actions, leading to unauthorized access or modifications.

Root Cause Analysis

The root cause of this vulnerability is the lack of proper authorization checks in the OpenStack Manila API controllers when handling operations on public shares. Specifically, the API does not verify that the caller owns the share before performing actions such as allowing or denying access, updating access levels, creating backups, soft-deleting, restoring, or manipulating export location metadata. This flaw enables an authenticated project member to perform these operations on any public share, regardless of ownership.

Attack Vector & Chain

The attack vector for this vulnerability involves an authenticated project member exploiting the vulnerable API operations to perform unauthorized actions on public shares. The attack chain includes:

  • Initial Access: The attacker gains access as an authenticated project member.
  • Exploitation: The attacker uses the vulnerable API operations to perform actions on public shares without ownership.

Exploitation Scenario Walkthrough

Scenario: Unauthorized Access to Public Shares via OpenStack Manila API

Reconnaissance: An attacker identifies a public share in OpenStack Manila and notes its UUID.

Weaponization: The attacker prepares to exploit the vulnerable API operations.

Delivery & Exploitation: The attacker sends a crafted API request to perform an action such as allow_access or create_share_backup on the public share, without being the share's owner.

Post-Exploitation: The attacker can grant themselves data-plane access, revoke the owner's access, escalate their access level, exfiltrate share data via backups, or interfere with the owner's management workflow.

Impact Realization: The attacker achieves unauthorized access or modification of share data, potentially leading to data breaches or service disruptions.

Exploitation in the Wild

The vulnerability is not currently known to be actively exploited in the wild. However, given its high severity and the potential for significant impact, there is a high likelihood that attackers will exploit this vulnerability if not promptly patched.

Impact Analysis

Direct Impact

The direct impact of this vulnerability includes:

  • Unauthorized data access or modification
  • Escalation of privileges
  • Data exfiltration via backups
  • Denial of service through share manipulation

Downstream & Cascading Effects

The downstream effects could include:

  • Supply chain risk if OpenStack Manila is used in a larger software supply chain
  • Regulatory implications due to potential data breaches
  • Operational disruptions due to unauthorized access or modifications

Affected Products & Versions

The affected versions of OpenStack Manila include:

  • 1.0.0 to 20.0.3
  • 21.0.0 to 21.0.3
  • 22.0.0 to 22.0.2
  • 23.0.0

The patched version is 23.0.1.

Detection & Threat Hunting

Indicators of Compromise

Indicators of compromise may include:

  • Unusual API requests to OpenStack Manila
  • Logs showing actions performed by users on shares they do not own

Detection Rules & Signatures

Detection rules may involve monitoring OpenStack Manila API logs for suspicious activity, such as:

  • Multiple allow_access or deny_access requests from a single authenticated user
  • Requests to create backups or modify share metadata from unexpected sources

Remediation & Hardening

Immediate Actions (0-24 hours)

Immediate patching to OpenStack Manila version 23.0.1 or later is recommended. In the absence of patching, restricting access to the OpenStack Manila API for sensitive operations may mitigate some risks.

Short-Term Hardening (1-7 days)

Additional security controls include:

  • Monitoring and logging enhancements
  • Network segmentation to limit access to OpenStack Manila
  • Implementing Web Application Firewalls (WAFs) to detect and prevent suspicious API requests

Strategic Recommendations

Long-term recommendations include:

  • Regular security audits and vulnerability assessments
  • Implementation of robust access controls and authentication mechanisms
  • Continuous monitoring and incident response planning

Analyst Assessment

The risk of inaction is high due to the critical nature of this vulnerability and the potential for significant impact. Organizations using affected versions of OpenStack Manila should prioritize patching to mitigate this risk. The likelihood of exploitation is expected to increase if the vulnerability remains unpatched, given its high severity and the potential benefits to attackers.

Sources

  • National Vulnerability Database (NVD) - CVE-2026-71195