Announce

By thread

announce@lists.alasca.cloud

October 2026

1 participants
1 message

[Security Advisory][cinder] Cross-project information disclosure in Cinder Messages API (CVE-2026-93856)

by Jonas Schäfer

Hi everyone, The YAOOK project just published a security advisory: https://yaook.cloud/security-advisories-cve-2026-93856/ Images are being pushed and will be available within then next few minutes. ## What is CVE-2026-93856 and how does it affect YAOOK? CVE-2026-93856 is a vulnerability in OpenStack cinder which allows an authenticated attacker with the “reader” or “member” role assigned to read Cinder messages from projects where they don’t have permissions. ## Is my cluster vulnerable? The following images are vulnerable: cinder images before 2.0.194. If an affected image is used in your cluster for the cinder-api deployment, the cluster is vulnerable. The fixed image has been built in a private pipeline [1] which has been published alongside this advisory to prove the image provenance. ## Upgrading A new stable release will be published according to the release cycle and hotfix releases will be produced starting now. You can upgrade to that release simply by updating your operators. If you want to patch cinder ahead of the next regular YAOOK release, you can set the YAOOK_OP_VERSIONS_OVERRIDE variable in your Cinder operator container to pull the image before the YAOOK comprehensive release is ready. The best way to do this is to set the following in the values.yaml of your cinder-operator (make sure to merge this correctly with an existing values.yaml, if you have that). operator: extraEnv: - name: YAOOK_OP_VERSIONS_OVERRIDE value: | { "registry.yaook.cloud/yaook/cinder-2024.1": "registry.yaook.cloud/yaook/cinder-2024.1:2.0.194", "registry.yaook.cloud/yaook/cinder-2024.2": "registry.yaook.cloud/yaook/cinder-2024.2:2.0.194", "registry.yaook.cloud/yaook/cinder-2025.1": "registry.yaook.cloud/yaook/cinder-2025.1:2.0.194", "registry.yaook.cloud/yaook/cinder-2025.2": "registry.yaook.cloud/yaook/cinder-2025.2:2.0.194", "registry.yaook.cloud/yaook/cinder-2026.1": "registry.yaook.cloud/yaook/cinder-2026.1:2.0.194" } If you are not using Helm, you can add the environment variable to the env section of your cinder-operator’s Deployment’s pod template. kind regards, Jonas Schäfer [1]: https://gitlab.com/yaook-security/images/cinder/-/pipelines/ 2967220013 -- Jonas Schäfer CTO Business Unit Cloud Cloud&Heat Technologies GmbH Königsbrücker Straße 96 | 01099 Dresden +49 351 479 367 37 jonas.schaefer(a)cloudandheat.com | www.cloudandheat.com Green, Open, Efficient. Your Cloud Service and Cloud Technology Provider from Dresden. https://www.cloudandheat.com/ Commercial Register: District Court Dresden Register Number: HRB 30549 VAT ID No.: DE281093504 Managing Director: Nicolas Röhrs Authorized signatory: Dr. Marius Feldmann

Oct. 20, 2026