Cinder Messages API can disclose cross-project data (CVE-2026-93856)
Original title: [OSSA-2026-045] Cinder: Cross-project information disclosure in Cinder Messages API (CVE-2026-93856)
The notice lists Cinder 9.0.0 before 26.3.1 and the exact releases 27.0.0, 28.0.0, and 29.0.0.
OpenStack advisory OSSA-2026-045 describes a cross-project information disclosure in the Cinder Messages API, tracked as CVE-2026-93856. Affected releases are Cinder 9.0.0 through versions before 26.3.1, plus 27.0.0, 28.0.0, and 29.0.0. The notice credits Yuliang Xiao and Chen YuXiang; the feed text cuts off before the full description.
Unconfirmed: The feed snippet ends during the description, so impact details and any fixed releases for 27, 28, and 29 are not stated.
- The advisory is OSSA-2026-045, dated October 20, 2026.
- Named reporters are Yuliang Xiao and Chen YuXiang; the institute name is cut off.
Impact: Cross-project information disclosure through the Cinder Messages API
| Product | Affected |
|---|---|
| OpenStack Cinder | >=9.0.0 <26.3.1, ==27.0.0, ==28.0.0, ==29.0.0 |
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-93856 | In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API | 4.3 | — |
From the original article
Posted by Brian Rosmaita on Oct 20 ========================================================================== OSSA-2026-045: Cross-project information disclosure in Cinder Messages API ========================================================================== :Date: October 20, 2026 :CVE: CVE-2026-93856 Affects ~~~~~~~ - Cinder: >=9. 0. 0 <26.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.