Login Request a demo
CY
Product
Cyborg
by OpenStack · last CVE May 7, 2026
2
CVEs
0
On KEV
7.4
Max CVSS
0
New 30D
Vulnerabilities2In the news0Timeline
Severity mix
Critical 0High 1Medium 1Low 0
Severity
All severities2Critical0High1Medium1Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Cyborg to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-40213
7.4
0%
May 7
OpenStack Cyborg before 16.0.1 uses rule:allow (check_str='@') as the default policy for multiple API endpoints
Affected: 5.0.0 before 14.0.1; 15.0.0 before 15.0.1; 16.0.0 before 16.0.1
CVE-2026-40214
6.3
0%
May 7
In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer
Affected: 3.0.0 before 14.0.1; 15.0.0 before 15.0.1; 16.0.0 before 16.0.1
Showing 2