Executive Summary

This vulnerability exists in OpenStack Cyborg versions before 16.0.1, where the default policy for multiple API endpoints uses rule:allow with check_str='@'. This means that any request with a valid Keystone token is unconditionally authorized, regardless of the user's roles, project membership, or scope.

As a result, an authenticated user who has no assigned roles can still perform various actions, including reprogramming FPGA bitstreams on arbitrary compute nodes via agent RPC.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an authenticated user with minimal privileges to perform unauthorized actions, such as reprogramming FPGA bitstreams on compute nodes. This can lead to unauthorized control over hardware resources, potentially causing data integrity issues, service disruptions, or further exploitation within the affected OpenStack environment.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate CVE-2026-40213, you should apply the available patches provided for multiple OpenStack Cyborg versions including 2025.1/epoxy, 2025.2/flamingo, 2026.1/gazpacho, and 2026.2/hibiscus.

The vulnerability is caused by default policy rules using rule:allow, which unconditionally authorizes any request with a valid Keystone token regardless of roles or project scope.

The fix involves replacing the rule:allow policy with stricter rules such as rule:admin_api for sensitive endpoints and rule:project_member_or_admin for accelerator request creation, and ensuring proper token scope validation.

Ensure that your OpenStack Cyborg deployment is updated to a patched version and review your policy files to avoid using rule:allow for critical API endpoints.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows any authenticated user with a valid Keystone token, even with zero role assignments, to perform unauthorized actions such as reprogramming FPGA bitstreams on arbitrary compute nodes. This unauthorized access and potential manipulation of system components could lead to breaches of confidentiality, integrity, and availability of data and systems.

Such unauthorized access and control could negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require strict access controls and protection of sensitive data and systems. The vulnerability undermines role-based access control mechanisms, increasing the risk of data exposure or system compromise.

Useful 0 Not Useful 0