{"id":5503,"date":"2026-10-20T16:00:44","date_gmt":"2026-10-20T14:00:44","guid":{"rendered":"https:\/\/yaook.cloud\/?page_id=5503"},"modified":"2026-10-20T16:00:45","modified_gmt":"2026-10-20T14:00:45","slug":"security-advisories-cve-2026-93856","status":"publish","type":"page","link":"https:\/\/yaook.cloud\/en\/security-advisories-cve-2026-93856\/","title":{"rendered":"security-advisories\/cve-2026-93856"},"content":{"rendered":"<div data-elementor-type=\"wp-page\" data-elementor-id=\"5503\" class=\"elementor elementor-5503\" data-elementor-post-type=\"page\">\n\t\t\t\t<div class=\"elementor-element elementor-element-f6c3232 e-flex e-con-boxed e-con e-parent\" data-id=\"f6c3232\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-9087ab7 elementor-widget elementor-widget-text-editor\" data-id=\"9087ab7\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h1>YAOOK Security Advisory CVE-2026-93856<\/h1><ul><li>Date: 2026-10-20<\/li><li>Upstream advisory: TBA<\/li><\/ul><h2>What is CVE-2026-93856 and how does it affect YAOOK?<\/h2><p>CVE-2026-93856 is a vulnerability in OpenStack cinder which allows an authenticated attacker with the \u201creader\u201d or \u201cmember\u201d role assigned to read Cinder messages from projects where they don\u2019t have permissions.<\/p><h2>Is my cluster vulnerable?<\/h2><p>The following images are vulnerable:<\/p><ul><li>cinder images before 2.0.194<\/li><li>yaook release before TBD<\/li><\/ul><p>If an affected image is used in your cluster for the cinder-api deployment, the\u00a0cluster is vulnerable.<\/p><p>The fixed image has been built in a <a href=\"https:\/\/gitlab.com\/yaook-security\/images\/cinder\/-\/pipelines\/2967220013\">private pipeline<\/a> which has been published alongside this advisory to prove the image provenance.<\/p><h2>Upgrading<\/h2><p>A new stable release will be published according to the release cycle and hotfix releases will be produced starting now. You can upgrade to that release simply by updating your operators.\u00a0<\/p><p>If you want to patch cinder ahead of the next regular YAOOK release, you can set the <a href=\"https:\/\/docs.yaook.cloud\/user\/references\/env-reference.html#envvar-YAOOK_OP_VERSIONS_OVERRIDE\">YAOOK_OP_VERSIONS_OVERRIDE<\/a>\u00a0variable in your Cinder operator container to pull the image before the YAOOK\u00a0comprehensive release is ready.<\/p><p>The best way to do this is to set the following in the values.yaml of your\u00a0cinder-operator (make sure to merge this correctly with an existing\u00a0values.yaml, if you have that).<\/p><pre>operator:<br \/>\u00a0\u00a0\u00a0 extraEnv:<br \/>\u00a0\u00a0\u00a0 - name: YAOOK_OP_VERSIONS_OVERRIDE<br \/>\u00a0\u00a0\u00a0 value: |<br \/>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 {<br \/>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \"registry.yaook.cloud\/yaook\/cinder-2024.1\": \"registry.yaook.cloud\/yaook\/cinder-2024.1:2.0.194\",<br \/>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \"registry.yaook.cloud\/yaook\/cinder-2024.2\": \"registry.yaook.cloud\/yaook\/cinder-2024.2:2.0.194\",<br \/>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \"registry.yaook.cloud\/yaook\/cinder-2025.1\": \"registry.yaook.cloud\/yaook\/cinder-2025.1:2.0.194\",<br \/>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \"registry.yaook.cloud\/yaook\/cinder-2025.2\": \"registry.yaook.cloud\/yaook\/cinder-2025.2:2.0.194\",<br \/>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \"registry.yaook.cloud\/yaook\/cinder-2026.1\": \"registry.yaook.cloud\/yaook\/cinder-2026.1:2.0.194\"<br \/>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 }<\/pre><p>If you are not using Helm, you can add the environment variable to the env\u00a0section of your cinder-operator\u2019s Deployment\u2019s pod template.<\/p><p>\u00a0<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>","protected":false},"excerpt":{"rendered":"<p>YAOOK Security Advisory CVE-2026-93856 Date: 2026-10-20 Upstream advisory: TBA What is CVE-2026-93856 and how does it affect YAOOK? CVE-2026-93856 is a vulnerability in OpenStack cinder which allows an authenticated attacker with the \u201creader\u201d or \u201cmember\u201d role assigned to read Cinder messages from projects where they don\u2019t have permissions. Is my cluster vulnerable? The following images [&hellip;]<\/p>\n","protected":false},"author":6,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"class_list":["post-5503","page","type-page","status-publish","hentry"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>security-advisories\/cve-2026-93856 &#187; Yaook<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/yaook.cloud\/en\/security-advisories-cve-2026-93856\/\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"security-advisories\/cve-2026-93856 &#187; Yaook\" \/>\n<meta property=\"og:description\" content=\"YAOOK Security Advisory CVE-2026-93856 Date: 2026-10-20 Upstream advisory: TBA What is CVE-2026-93856 and how does it affect YAOOK? CVE-2026-93856 is a vulnerability in OpenStack cinder which allows an authenticated attacker with the \u201creader\u201d or \u201cmember\u201d role assigned to read Cinder messages from projects where they don\u2019t have permissions. Is my cluster vulnerable? The following images [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/yaook.cloud\/en\/security-advisories-cve-2026-93856\/\" \/>\n<meta property=\"og:site_name\" content=\"Yaook\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-20T14:00:45+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/yaook.cloud\\\/security-advisories-cve-2026-93856\\\/\",\"url\":\"https:\\\/\\\/yaook.cloud\\\/security-advisories-cve-2026-93856\\\/\",\"name\":\"security-advisories\\\/cve-2026-93856 &#187; Yaook\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/yaook.cloud\\\/#website\"},\"datePublished\":\"2026-10-20T14:00:44+00:00\",\"dateModified\":\"2026-10-20T14:00:45+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/yaook.cloud\\\/security-advisories-cve-2026-93856\\\/#breadcrumb\"},\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/yaook.cloud\\\/security-advisories-cve-2026-93856\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/yaook.cloud\\\/security-advisories-cve-2026-93856\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Startseite\",\"item\":\"https:\\\/\\\/yaook.cloud\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"security-advisories\\\/cve-2026-93856\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/yaook.cloud\\\/#website\",\"url\":\"https:\\\/\\\/yaook.cloud\\\/\",\"name\":\"Yaook\",\"description\":\"The Lifecycle Management Tool for OpenStack\",\"publisher\":{\"@id\":\"https:\\\/\\\/yaook.cloud\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/yaook.cloud\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-GB\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/yaook.cloud\\\/#organization\",\"name\":\"ALASCA e.V.\",\"alternateName\":\"Alasca - Verband f\u00fcr betriebsf\u00e4hige, offene Cloud-Infrastrukturen e.V.\",\"url\":\"https:\\\/\\\/yaook.cloud\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\\\/\\\/yaook.cloud\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/alasca.cloud\\\/wp-content\\\/uploads\\\/2022\\\/08\\\/favicon.png\",\"contentUrl\":\"https:\\\/\\\/alasca.cloud\\\/wp-content\\\/uploads\\\/2022\\\/08\\\/favicon.png\",\"width\":512,\"height\":512,\"caption\":\"ALASCA e.V.\"},\"image\":{\"@id\":\"https:\\\/\\\/yaook.cloud\\\/#\\\/schema\\\/logo\\\/image\\\/\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"security-advisories\/cve-2026-93856 &#187; Yaook","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/yaook.cloud\/en\/security-advisories-cve-2026-93856\/","og_locale":"en_GB","og_type":"article","og_title":"security-advisories\/cve-2026-93856 &#187; Yaook","og_description":"YAOOK Security Advisory CVE-2026-93856 Date: 2026-10-20 Upstream advisory: TBA What is CVE-2026-93856 and how does it affect YAOOK? CVE-2026-93856 is a vulnerability in OpenStack cinder which allows an authenticated attacker with the \u201creader\u201d or \u201cmember\u201d role assigned to read Cinder messages from projects where they don\u2019t have permissions. Is my cluster vulnerable? The following images [&hellip;]","og_url":"https:\/\/yaook.cloud\/en\/security-advisories-cve-2026-93856\/","og_site_name":"Yaook","article_modified_time":"2026-10-20T14:00:45+00:00","twitter_card":"summary_large_image","twitter_misc":{"Estimated reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/yaook.cloud\/security-advisories-cve-2026-93856\/","url":"https:\/\/yaook.cloud\/security-advisories-cve-2026-93856\/","name":"security-advisories\/cve-2026-93856 &#187; Yaook","isPartOf":{"@id":"https:\/\/yaook.cloud\/#website"},"datePublished":"2026-10-20T14:00:44+00:00","dateModified":"2026-10-20T14:00:45+00:00","breadcrumb":{"@id":"https:\/\/yaook.cloud\/security-advisories-cve-2026-93856\/#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/yaook.cloud\/security-advisories-cve-2026-93856\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/yaook.cloud\/security-advisories-cve-2026-93856\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Startseite","item":"https:\/\/yaook.cloud\/"},{"@type":"ListItem","position":2,"name":"security-advisories\/cve-2026-93856"}]},{"@type":"WebSite","@id":"https:\/\/yaook.cloud\/#website","url":"https:\/\/yaook.cloud\/","name":"Yaook","description":"The Lifecycle Management Tool for OpenStack","publisher":{"@id":"https:\/\/yaook.cloud\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/yaook.cloud\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":"Organization","@id":"https:\/\/yaook.cloud\/#organization","name":"ALASCA e.V.","alternateName":"Alasca - Verband f\u00fcr betriebsf\u00e4hige, offene Cloud-Infrastrukturen e.V.","url":"https:\/\/yaook.cloud\/","logo":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/yaook.cloud\/#\/schema\/logo\/image\/","url":"https:\/\/alasca.cloud\/wp-content\/uploads\/2022\/08\/favicon.png","contentUrl":"https:\/\/alasca.cloud\/wp-content\/uploads\/2022\/08\/favicon.png","width":512,"height":512,"caption":"ALASCA e.V."},"image":{"@id":"https:\/\/yaook.cloud\/#\/schema\/logo\/image\/"}}]}},"_links":{"self":[{"href":"https:\/\/yaook.cloud\/en\/wp-json\/wp\/v2\/pages\/5503","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/yaook.cloud\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/yaook.cloud\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/yaook.cloud\/en\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/yaook.cloud\/en\/wp-json\/wp\/v2\/comments?post=5503"}],"version-history":[{"count":4,"href":"https:\/\/yaook.cloud\/en\/wp-json\/wp\/v2\/pages\/5503\/revisions"}],"predecessor-version":[{"id":5508,"href":"https:\/\/yaook.cloud\/en\/wp-json\/wp\/v2\/pages\/5503\/revisions\/5508"}],"wp:attachment":[{"href":"https:\/\/yaook.cloud\/en\/wp-json\/wp\/v2\/media?parent=5503"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}