Is CVE-2026-40214 actively exploited?

No active exploitation of CVE-2026-40214 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-40214 be exploited remotely?

Yes. CVE-2026-40214 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-40214?

CVE-2026-40214 has a CVSS score of 6.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-40214

MEDIUM

CVE-2026-40214

CWE-282Published: May 7, 2026· Updated: May 8, 2026

6.3

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:9.9th

Official Description

In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer. The project_id column in the database is never populated (NULL for every ARQ), database queries have no project filtering, and policy checks are self-referential (the authorize_wsgi decorator compares the caller's project_id with itself rather than the target resource). Any authenticated non-admin user can complete various actions such as deleting ARQs bound to other projects' instances, aka cross-tenant denial of service.

NVD Source

Technical Analysis

CVE-2026-40214 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.