OSSA-2026-046: Manila allows cross-project public-share and export-metadata changes

Date:

October 20, 2026

CVE:

CVE-2026-71195

Affects

  • Manila: >=1.0.0 <20.0.3, >=21.0.0 <21.0.3, >=22.0.0 <22.0.2, ==23.0.0

Description

Chen YuXiang from the Institute of Computing Technology, Chinese Academy of Sciences reported that a non-owner could modify access rules and export-location metadata of another project’s public share. Goutham Pacha Ravi and Carlos da Silva from Red Hat identified further public-share paths: a non-owner could soft-delete or restore a foreign public share, or create a backup of it. A compatible storage backend may apply unauthorized changes to existing access rules, disrupting access for the share’s owner or authorized users.

Separately, Yuliang Xiao reported that the export-location metadata API does not scope its lookup to the share in the request. An authenticated project member may therefore read, modify, or delete another project’s export-location metadata by supplying the target export-location UUID with the identifier of a share they control. This issue is more easily exploitable with public shares.

Deployments with public shares are affected by the public-share operations. Deployments that utilize export-location metadata for shares are affected by the metadata vulnerability.

Patches

Credits

  • Chen YuXiang from Institute of Computing Technology, Chinese Academy of Sciences (CVE-2026-71195)

  • Yuliang Xiao (CVE-2026-71195)

References

Notes