Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer. The projectid column in the database is never populated (NULL for every ARQ), database queries have no project filtering, and policy checks are self-referential (the authorizewsgi decorator compares the caller's projectid with itself rather than the target resource). Any authenticated non-admin user can complete various actions such as deleting ARQs bound to other projects' instances, aka cross-tenant denial of service.
Recommended action: Upgrade to 16.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OpenStack Cyborg before 16.0.1 uses rule:allow (checkstr='@') as the default policy for multiple API endpoints. This unconditionally authorizes any request carrying a valid Keystone token regardless of roles, project membership, or scope. An authenticated user with zero role assignments can complete various actions such as reprogramming FPGA bitstreams on arbitrary compute nodes via agent RPC.
Recommended action: Upgrade to 16.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.