debian/manila vulnerabilities

Latest debian/manila CVEs

Newest publication first

1. CVE-2026-71195 manila: manila: Public Manila Share Allows Cross-Project Access-Rule and Export-Metadata Writes

   Published 2026-10-21

   Critical·CVSS 9.9 EPSS 0.48%

   In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize operations against the caller's own project context, then load a foreign public share without re-authorizing against the...

2. CVE-2020-9543 OpenStack Manila Unprivileged users can retrieve, use and manipulate share networks

   Published 2020-03-12

   High·CVSS 8.3 EPSS 1.3%

   OpenStack Manila <7.4.1, >=8.0.0 <8.1.1, and >=9.0.0 <9.1.1 allows attackers to view, update, delete, or share resources that do not belong to them, because of a context-free lookup of a UUID. Attackers may also create resources, such as shared file systems and groups of shares o...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.