OpenStack Manila vulnerabilities

Latest OpenStack Manila CVEs

Newest publication first

1. CVE-2026-71195 manila: manila: Public Manila Share Allows Cross-Project Access-Rule and Export-Metadata Writes

   Published 2026-10-21

   Critical·CVSS 9.9 EPSS 0.48%

   In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize operations against the caller's own project context, then load a foreign public share without re-authorizing against the...

2. CVE-2020-9543 OpenStack Manila Unprivileged users can retrieve, use and manipulate share networks

   Published 2020-03-12

   High·CVSS 8.3 EPSS 1.3%

   OpenStack Manila <7.4.1, >=8.0.0 <8.1.1, and >=9.0.0 <9.1.1 allows attackers to view, update, delete, or share resources that do not belong to them, because of a context-free lookup of a UUID. Attackers may also create resources, such as shared file systems and groups of shares o...

3. CVE-2016-6519 Openstack Manila Persistent XSS in Metadata field

   Published 2017-04-21

   Medium·CVSS 5.4 EPSS 1.5%

   Cross-site scripting (XSS) vulnerability in the "Shares" overview in Openstack Manila before 2.5.1 allows remote authenticated users to inject arbitrary web script or HTML via the Metadata field in the "Create Share" form.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.