HIGH7.4PyPI
GHSA-mm7j-mhhj-hj36· CVE-2026-40213, PYSEC-2026-2853OpenStack Cyborg uses rule:allow (check_str='@') as the default policy for multiple API endpoints
Modified: 7/13/2026
package
PyPI/openstack-cyborg
pkg:pypi/openstack-cyborg
MEDIUM6.3PyPI
GHSA-mmpc-xjxr-5hf8· CVE-2026-40214, PYSEC-2026-2854OpenStack Cyborg's Accelerator Request (ARQ) API does not enforce project ownership at any layer
Modified: 7/13/2026
HIGH7.4PyPI
PYSEC-2026-2853· CVE-2026-40213, GHSA-mm7j-mhhj-hj36OpenStack Cyborg uses rule:allow (check_str='@') as the default policy for multiple API endpoints
Modified: 7/13/2026
MEDIUM6.3PyPI
PYSEC-2026-2854· CVE-2026-40214, GHSA-mmpc-xjxr-5hf8OpenStack Cyborg's Accelerator Request (ARQ) API does not enforce project ownership at any layer
Modified: 7/13/2026