Ubuntu 26.04 LTS Cyborg Critical API Flaws Denial of Service USN-8413-1

A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 26.04 LTS - Ubuntu 25.10 Summary: Several security issues were fixed in Cyborg. Software Description: - cyborg: OpenStack Acceleration as a Service Details: It was discovered that Cyborg did not properly enforce project ownership in the Accelerator Request (ARQ) API. An authenticated user could possibly use this issue to delete ARQs bound to other projects' instances, resulting in a cross-tenant denial of service. (CVE-2026-40214) It was discovered that Cyborg used a permissive default policy that authorized any request carrying a valid authentication token, regardless of roles or scope, for multiple API endpoints. An authenticated user could possibly use this issue to perform unauthorized actions, such as reprogramming FPGA bitstreams on arbitrary compute nodes. (CVE-2026-40213)