Key points
- CVE-2026-71195 affects Manila versions 1.0.0 through 23.0.0, excluding specific patched releases.
- The flaw allows cross-project modifications to public-share status and export metadata.
- Patches are available for affected versions up to the 23.0.0 release line.
OpenStack Manila versions 1.0.0 through 20.0.2, 21.0.0 through 21.0.2, 22.0.0 through 22.0.1, and 23.0.0 are affected by CVE-2026-71195. According to an advisory from the oss-security mailing list posted on October 20, 2026, these versions contain a flaw that permits unauthorized changes. The issue allows users to modify public-share settings and export metadata for shares belonging to other projects.
In plain English
The vulnerability in OpenStack Manila breaks the isolation between different user projects. A user can change whether a file share is public or private. They can also alter the export metadata associated with that share. This happens even if the share belongs to a different project. The flaw was identified by Chen YuXiang, according to the advisory. This means project boundaries do not stop these specific configuration changes.
The background
The oss-security mailing list published advisory OSSA-2026-046 on October 20, 2026. The advisory details the scope of the issue across multiple major version lines. It lists specific version ranges that remain vulnerable. Versions 20.0.3, 21.0.3, and 22.0.2 are not affected. The advisory does not provide technical details on the code path. It focuses on the affected versions and the nature of the access control bypass.
What changes now
Administrators must check their Manila version against the affected list. If their version is within the vulnerable ranges, they should apply the relevant update. The advisory confirms that fixes exist for the listed version lines. Teams should prioritize systems exposed to untrusted users. The update restores proper project isolation for share settings. This prevents cross-project tampering with share visibility and metadata.
Who needs to act first
Security teams should prioritize updating systems that host shares for untrusted or multi-tenant users. Check whether your environment allows cross-project visibility before patching. Roll out updates to production systems after testing in a staging environment. Back up configuration files before making changes. Reduce exposure by restricting network access to the Manila API endpoints while planning the update. Monitor logs for unauthorized metadata changes during the transition.
What to do and how to stay safe: OpenStack
- Verify your OpenStack Manila version against the affected ranges in the advisory.
- Apply the vendor-provided update to patch the cross-project access control flaw.
- Review share configurations for unexpected changes in public status or metadata.
- Restrict API access to trusted networks until all systems are patched.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which OpenStack Manila versions are affected by CVE-2026-71195?
Versions 1.0.0 to 20.0.2, 21.0.0 to 21.0.2, 22.0.0 to 22.0.1, and 23.0.0 are affected.
Is there a fix available for this vulnerability?
Yes, patches are available for the affected version lines, including 20.0.3, 21.0.3, and 22.0.2.
What can an attacker do with this flaw?
An attacker can change public-share settings and export metadata for shares in other projects.
