Key points
- CVE-2026-93856 affects OpenStack Cinder versions 9.0.0 up to 26.3.1, plus 27.0.0, 28.0.0, and 29.0.0.
- The flaw enables cross-project information disclosure via the Messages API.
- No patch or fix has been confirmed for this vulnerability as of the advisory date.
OpenStack Cinder contains a security flaw that allows cross-project information disclosure via the Messages API. The issue, tracked as CVE-2026-93856, was disclosed in an official advisory posted to the oss-security mailing list on October 20, 2026. The vulnerability affects specific versions of the software, including 9.0.0 up to 26.3.1, as well as versions 27.0.0, 28.0.0, and 29.0.0.
In plain English
Cloud infrastructure managers use OpenStack Cinder to manage block storage. This bug allows a user to potentially view information belonging to a different project on the same host. It is a cross-project information disclosure issue, meaning isolation between tenant workloads is compromised. The source material does not specify exactly what data is leaked, only that it occurs via the Messages API.
The background
The vulnerability was identified by Yuliang Xiao, an independent security researcher, and Chen YuXiang from the Institute of Software at the Chinese Academy of Sciences. Their findings were published in advisory OSSA-2026-045. The affected versions are discrete: any version from 9.0.0 up to 26.3.1, and specifically versions 27.0.0, 28.0.0, and 29.0.0.
What changes now
Security teams must assess their OpenStack deployments immediately to determine if they are running the specific vulnerable versions of Cinder listed in the advisory. Since no official patch has been released or confirmed in the source material, operators cannot simply apply an update to resolve the issue. Exposure remains high for any environment using the affected version ranges without additional compensating controls.
Who needs to act first
Teams usually prioritize systems exposed to untrusted users or multi-tenant environments first. Check whether your Cinder deployments allow cross-project API access or if network segmentation limits lateral movement. Back up current configurations and logs before making any changes. If possible, isolate the Messages API endpoint behind stricter firewall rules or authentication proxies. Monitor logs for unusual access patterns that might indicate exploitation attempts.
What to do and how to stay safe: OpenStack
- Audit all OpenStack deployments to identify instances running the specific vulnerable Cinder versions.
- Restrict network access to the Cinder Messages API to only trusted management interfaces.
- Monitor API logs for requests originating from unexpected user accounts or projects.
- Review tenant isolation policies to ensure no other components expose cross-project data.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which OpenStack Cinder versions are affected by CVE-2026-93856?
Versions 9.0.0 up to 26.3.1, as well as versions 27.0.0, 28.0.0, and 29.0.0 are affected.
Is there a patch available for this vulnerability?
No fix has been confirmed yet according to the provided source material.
Who discovered this security flaw?
Yuliang Xiao and Chen YuXiang of the Institute of Software at the Chinese Academy of Sciences discovered it.
