External risk intelligence

OpenStack Manila Unauthorized Public Share Operations

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-71195

The vulnerability resides in the OpenStack Manila API, which is a core service component typically exposed to authenticated tenants. While it requires authentication, the API is an edge-facing service designed for multi-tenant interaction, making it a commonly reachable service in cloud environments where such APIs are accessible for management and data-plane operations.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

An issue in OpenStack Manila allows authenticated users to perform unauthorized operations on public shares belonging to other tenants. This could enable actions such as granting access, deleting or modifying shares, exfiltrating data through backups, or revealing sensitive metadata and access keys. The vulnerability is in API operations that do not sufficiently re-verify ownership before acting on a shared resource.

Unauthorized actions on shared data.
Affects core cloud infrastructure management.
Confirm relevance and exposure of public shares.

Attack Path

How an attacker could exploit the issue

An attacker with authenticated access to the OpenStack Manila API can manipulate public shares that do not belong to them. By performing certain API operations, such as allowing or denying access, creating backups, or deleting shares, the attacker can gain unauthorized control or exfiltrate data. This is possible because the API operations do not re-verify ownership of public shares after initial authorization.

Authenticated API access is required.
API operations on public shares trigger the flaw.
Unauthorized access, data exfiltration, and service disruption.

Live Threat

Current exploitation, exposure, and threat context

An authenticated project member could access, modify, or delete another tenant's public Manila share and its associated data when these specific API operations are not properly authorized. This could lead to unauthorized data access, modification, or service disruption for the share's actual owner.

Share data and metadata.
Unauthenticated API operations.
Unauthorized data access or modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

The OpenStack Manila API is a shared component, meaning platform or infrastructure teams are likely responsible for its upkeep. The first practical step is to identify all instances of Manila, determine their exposure and criticality, and then pinpoint the accountable owner for remediation.

Platform/Infrastructure teams own the issue.
Verify Manila API instances and reachability.
Plan remediation based on ownership and risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is OpenStack Manila?

OpenStack Manila is a shared file system service for cloud environments. It allows users to provision and manage file shares that can be mounted by multiple compute instances. It acts as a central management layer, enabling multi-tenant access to storage resources across a cloud infrastructure.

What does CWE-863 mean for CVE-2026-71195?

CWE-863 is the weakness class for incorrect authorization. In this CVE, the Manila API fails to re-verify that a user owns a public share before performing actions on it. Although the system checks if the user has general access, it neglects to confirm ownership rights for specific operations, allowing unauthorized users to interact with files they do not own.

Do I need to be an administrator to trigger this bug?

No. You do not need administrative privileges to trigger this vulnerability. Any standard, authenticated project member within the OpenStack environment can execute these operations against any public share. The vulnerability is not triggered by internal administrative actions, but rather by standard API calls made by regular authenticated users.

Is this vulnerability relevant to my OpenStack environment?

Halo Surface Signal identifies this as highly relevant if your Manila API is reachable by tenants, as it is an edge-facing service. Since the API is designed for multi-tenant interaction, it is typically accessible in cloud environments. If your infrastructure supports public shares and allows authenticated user access to the API, your environment is potentially affected.

How should I respond to this Manila vulnerability?

Platform and infrastructure teams should prioritize identifying all instances of Manila within their cloud environment. Once identified, verify which instances are active and accessible. You should work with the team responsible for infrastructure maintenance to plan for the necessary updates, ensuring that ownership verification is properly enforced for all public share operations.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.