OpenStack Manila allows cross-project share changes (CVE-2026-71195)
Original title: [OSSA-2026-046] OpenStack Manila: Manila allows cross-project public-share and export-metadata changes (CVE-2026-71195)
OSSA-2026-046, dated October 20, lists affected Manila lines including releases before 22.0.2 and version 23.0.0; the description is cut off.
OpenStack published OSSA-2026-046 on October 20 for CVE-2026-71195. Manila can allow cross-project changes to public shares and export metadata. The notice lists affected Manila ranges beginning at 1.0.0 and including 22.0.0 before 22.0.2 and 23.0.0. The description, credited to Chen YuXiang, is truncated in the feed.
Unconfirmed: The feed cuts off the description, and no fixed release is explicitly named.
- The advisory is OSSA-2026-046, dated October 20, 2026.
- The listed ranges include Manila >=1.0.0, 22.0.0 before 22.0.2, and 23.0.0.
- No exploitation status appears in the excerpt.
Impact: Cross-project changes to public shares and export metadata
| Product | Affected |
|---|---|
| OpenStack Manila | >=1.0.0, =21.0.0, =22.0.0 <22.0.2, ==23.0.0 |
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-71195 | Missing ownership checks on public shares in OpenStack Manila before 23.0.1 | 9.9 | — |
From the original article
Posted by Goutham Pacha Ravi on Oct 20 =================================================================================== OSSA-2026-046: Manila allows cross-project public-share and export-metadata changes =================================================================================== :Date: October 20, 2026 :CVE: CVE-2026-71195 Affects ~~~~~~~ - Manila: >=1. 0. 0 =21.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.