[OSSA-2026-040] OpenStack Blazar: Multiple authorization vulnerabilities in the Blazar V2 lease API (CVE-2026-93852, CVE-2026-93854) · ZeroHour

oss-securitypublished Sep 21, 17:20 UTC (5d ago)ingested Sep 21, 17:30 UTC

[OSSA-2026-040] OpenStack Blazar: Multiple authorization vulnerabilities in the Blazar V2 lease API (CVE-2026-93852, CVE-2026-93854)

mediumVulnerabilityimportance 46CVE-2026-93852 CVE-2026-93854

AI summary · grok-4.7

OpenStack Blazar's V2 lease API has authorization flaws CVE-2026-93852 and CVE-2026-93854.

OpenStack published OSSA-2026-040 on September 21, 2026, describing multiple authorization vulnerabilities in the Blazar V2 lease API. CVE-2026-93852 and CVE-2026-93854 affect Blazar from 1.0.0 before 15.1.1, as well as versions 16.0.0 and 17.0.0. Rohan Das is credited with the report. The disclosure does not say the flaws are being exploited.

OSSA-2026-040 covers two authorization flaws in the Blazar V2 lease API.
Affected releases are 1.0.0 through before 15.1.1, plus 16.0.0 and 17.0.0.
CVEs are CVE-2026-93852 and CVE-2026-93854; active exploitation is not reported.

Read the original

VendorsOpenStack

ProductsBlazar

OrganizationsOpenStack

Tags#openstack #blazar #authorization #ossa #cve-2026-93852 #cve-2026-93854

Vulnerabilities mentionedAll →

CVE-2026-938527.1—
Missing authorization in OpenStack Blazar exposes leases across all tenants
published 8d ago· OpenStack Foundation OpenStack Blazar
CVE-2026-938547.2—
Broken Object-Level Authorization in OpenStack Blazar Lease API
published 8d ago· OpenStack Blazar

CVE	Vulnerability	CVSS	EPSS	Flags	Affected

Full article

Posted by Goutham Pacha Ravi on Sep 21 ================================================================================ OSSA-2026-040: Multiple authorization vulnerabilities in the Blazar V2 lease API ================================================================================ :Date: September 21, 2026 :CVE: CVE-2026-93852, CVE-2026-93854 Affects ~~~~~~~ - Blazar: >=1.0.0 <15.1.1, ==16.0.0, ==17.0.0 Description ~~~~~~~~~~~ Rohan Das from the University of...

This source does not provide full text. Read it at seclists.org.

Missing authorization in OpenStack Blazar exposes leases across all tenants

OpenStack Blazar before 17.0.1 fails to enforce project scoping or an administrator-only policy on the V2 lease listing operation (GET /v2/leases), a CWE-862 missing-authorization flaw. Any authenticated user who can reach the Blazar REST API can retrieve leases belonging to every project, exposing lease IDs, reservation IDs, resource IDs, and reservation metadata. The disclosed lease IDs also enable the companion object-level authorization bypass, letting an attacker modify or delete other tenants' enumerated leases. Only OpenStack deployments running the optional Blazar reservation service are affected, and only where tenants can access the Blazar API. No public proof-of-concept or in-the-wild exploitation is currently known.

Do: Upgrade Blazar to 17.0.1 or later, which adds project scoping/policy enforcement to the lease listing endpoint. Until patched, restrict network access to the Blazar API to trusted administrators and audit lease records for unauthorized cross-tenant modifications or deletions. If lease IDs were exposed, treat all enumerated leases as potentially tamperable and rotate or review reservations accordingly.

7.1

—

OpenStack Foundation OpenStack Blazar before 17.0.1

nichelikely hundreds to a few thousand tenant users (Blazar is an optional OpenStack reservation service deployed by only a minority of clouds)

8d ago

Broken Object-Level Authorization in OpenStack Blazar Lease API

OpenStack Blazar before 17.0.1 fails to enforce object-level authorization on lease update and delete requests (PUT/DELETE /v2/leases/{lease_id}) because the policy wrapper looks up the target lease under the keyword "lease_id" while the controller names the parameter "id", so the lookup returns None and the ownership check silently falls back to the requesting user's own project_id/user_id. Any authenticated user who knows or obtains another tenant's lease ID can send an update or delete request and bypass the intended ownership check. As a result, an attacker can modify or delete leases (resource reservations) belonging to other users and projects, causing high integrity and availability impact, though no confidentiality loss. All OpenStack clouds running Blazar prior to 17.0.1 are affected. No public proof-of-concept exists, the flaw is not in CISA's KEV catalog, and no exploitation has been reported.

Do: Upgrade to Blazar 17.0.1 or later. Until patched, restrict PUT/DELETE access on /v2/leases to trusted projects via policy or an API gateway, and audit lease update/delete logs for cross-project modifications. Verify whether your deployment exposes the Blazar V2 API to general tenants.

7.2

—

OpenStack Blazar all versions before 17.0.1

nichelikely only hundreds to a few thousand Blazar deployments worldwide (optional OpenStack service, authenticated-only API)

8d ago