[oss-security] [OSSA-2026-046] OpenStack Manila: Manila allows cross-project public-share and export-metadata changes (CVE-2026-71195)

[Goutham Pacha Ravi]

===================================================================================

===================================================================================

:Date: October 20, 2026
:CVE: CVE-2026-71195


Affects
~~~~~~~
- Manila: >=1.0.0 <20.0.3, >=21.0.0 <21.0.3, >=22.0.0 <22.0.2, ==23.0.0


Description
~~~~~~~~~~~
Chen YuXiang from the Institute of Computing Technology, Chinese Academy of
Sciences reported that a non-owner could modify access rules and
export-location metadata of another project's public share. Goutham Pacha
Ravi and Carlos da Silva from Red Hat identified further public-share paths:
a non-owner could soft-delete or restore a foreign public share, or create a
backup of it. A compatible storage backend may apply unauthorized changes to
existing access rules, disrupting access for the share's owner or authorized
users.

Separately, Yuliang Xiao reported that the export-location metadata API does
not scope its lookup to the share in the request. An authenticated project

metadata by supplying the target export-location UUID with the identifier of
a share they control. This issue is more easily exploitable with public
shares.

Deployments with public shares are affected by the public-share operations.




Patches
~~~~~~~
- https://review.opendev.org/1011483 (2025.1/epoxy)
- https://review.opendev.org/1011482 (2025.2/flamingo)
- https://review.opendev.org/1011481 (2026.1/gazpacho)
- https://review.opendev.org/1011479 (2026.2/hibiscus)
- https://review.opendev.org/1011478 (2027.1/indri (development))


Credits
~~~~~~~

- Yuliang Xiao (CVE-2026-71195)


References
~~~~~~~~~~
- https://bugs.launchpad.net/manila/+bug/2161412
- https://bugs.launchpad.net/manila/+bug/2168962
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-71195


Notes
~~~~~
- The companion Manila Tempest plugin update,
  https://review.opendev.org/1011484, updates cross-project export-
  location tests to expect 404 after the fix.

--
Goutham Pacha Ravi
OpenStack Vulnerability Management Team
https://security.openstack.org/vmt.html

OSSA-2026-046: Manila allows cross-project public-share and export-metadata changes member may therefore read, modify, or delete another project's export-location Deployments that utilize export-location metadata for shares are affected by the metadata vulnerability. - Chen YuXiang from Institute of Computing Technology, Chinese Academy of Sciences (CVE-2026-71195)

OpenPGP_0x0638DAD3B82C3988.asc
Description: OpenPGP public key

OpenPGP_signature.asc
Description: OpenPGP digital signature