OpenStack Manila Inadequate Authorization on Public Shares

In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize operations against the caller's own project context, then load a foreign public share without re-authorizing against the share's actual owner. This affects the following operations: allow_access: grant data-plane read/write access to another tenant's share; deny_access: revoke the owner's existing access rules; update_access: escalate access level (e.g., ro to rw); create_share_backup: exfiltrate share data via a backup created under the attacker's project; soft_delete: move a foreign share to the recycle bin; restore: interfere with the owner's deletion workflow; export location metadata: create, update, and delete metadata on foreign export locations; access rule listing: disclose IPs, usernames, and CephFS keys. Any authenticated project member can exploit these operations on any public share. The share UUID is visible since t

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-71195 is a critical authorization bypass in OpenStack Manila that allows attackers to manipulate access controls on public shares belonging to other tenants. The vulnerability stems from a flawed authorization flow where API controllers validate requests against the caller's project context but fail to re-authorize operations against the share owner's actual permissions. This means an attacker can grant themselves data-plane access to another organization's shares, revoke legitimate access rules, or escalate privileges—effectively compromising the multi-tenant isolation that cloud storage depends on. Organizations running affected Manila versions face risks of unauthorized data access, denial of service against shared resources, and potential compliance violations in regulated environments.

Casky's 283 mapped security skills leverage Claude's extended reasoning to detect the attack patterns associated with TA0004 (Privilege Escalation) and TA0006 (Credential Access) techniques underlying this CVE. When analyzing API telemetry and authorization logs, practitioners would identify suspicious patterns: cross-tenant share access from unusual service principals, unexpected allow_access operations on shares the caller doesn't own, or deny_access calls that strip the legitimate owner's permissions. Casky correlates these signals against CWE-863 (Incorrect Authorization) indicators—specifically authorization decisions made without full context validation—to surface authorization bypass attempts in real time. The platform would flag scenarios where project-level authorization passes but share-ownership verification fails, enabling teams to catch exploitation before data exfiltration occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-71195.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-71195

Casky has 283 skills that investigate the attack patterns behind CVE-2026-71195. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn