OpenStack Cyborg versions prior to 16.0.1 contain an improper ownership management vulnerability (CWE-282) in the Accelerator Request (ARQ) API. The root cause is that the project_id column in the ARQ database table is never populated, resulting in NULL values for all ARQs. Consequently, database queries do not filter by project, and policy authorization checks are self-referential, comparing the caller's project_id against itself rather than the resource's project_id. This flaw permits any authenticated user without admin privileges to manipulate ARQs belonging to other tenants, including deleting ARQs bound to instances of other projects, effectively enabling cross-tenant denial of service attacks.

The vulnerability allows authenticated non-admin users to bypass project ownership restrictions and perform unauthorized actions on ARQs belonging to other tenants. This can lead to denial of service conditions affecting other projects by deleting their ARQs. The confidentiality and integrity impacts are limited to the ability to manipulate ARQs across tenants. There are no known exploits in the wild as of the published date. The CVSS v3.1 base score is 6.3 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Patch status is not yet confirmed — no official fix or patch information is provided in the vendor advisory or other sources. Users should monitor OpenStack Cyborg vendor advisories for updates addressing this vulnerability. Until a patch is available, restricting access to the Cyborg API to trusted users and limiting authentication to highly trusted accounts may reduce risk. No vendor advisory states that the issue is already mitigated or requires no action.