Blazar vulnerabilities

2 known vulnerabilities in Blazar from OpenStack. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.2 High severity

  Blazar: Comparison Using Wrong Factors

  CVE-2026-93854Sep 18, 2026OpenStack

  In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce object-level authorization on its update and delete operations (PUT /v2/leases/{lease_id} and DELETE /v2/leases/{lease_id}). The policy authorize() wrapper attempts to load the target lease t

• 7.1 High severity

  Blazar: Missing Authorization

  CVE-2026-93852Sep 18, 2026OpenStack

  In OpenStack Blazar before 17.0.1, the V2 lease listing operation (GET /v2/leases) returns leases for every project without enforcing project scoping or an administrator-only policy. Any authenticated user with access to the Blazar REST API can enumerate lease