Back Linuxsecurity

Ubuntu 26.04 LTS Cyborg Critical API Flaws Denial of Service USN-8413

Linuxsecurity •LinuxSecurity Advisories • June 9, 2026

A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 26.04 LTS - Ubuntu 25.10 Summary: Several security issues were fixed in Cyborg. Software Description: - cyborg: OpenStack Acceleration as a Service Details: It was discovered that Cyborg did not properly enforce project ownership in the Accelerator Request (ARQ) API. An authenticated user could possibly use this issue to delete ARQs bound to other projects' instances, resulting in a cross-tenant denial of service. (CVE-2026-40214) It was discovered that Cyborg used a permissive default policy that authorized any request carrying a valid authentication token, regardless of roles or scope, for multiple API endpoints. An authenticated user could possibly use this issue to perform unauthorized actions, such as reprogramming FPGA bitstreams on arbitrary compute nodes. (CVE-2026-40213)

The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS cyborg-agent 16.0.0-2ubuntu0.1 cyborg-api 16.0.0-2ubuntu0.1 cyborg-common 16.0.0-2ubuntu0.1 cyborg-conductor 16.0.0-2ubuntu0.1 python3-cyborg 16.0.0-2ubuntu0.1 Ubuntu 25.10 cyborg-agent 14.0.0-3+deb13u1build0.25.10.1 cyborg-api 14.0.0-3+deb13u1build0.25.10.1 cyborg-common 14.0.0-3+deb13u1build0.25.10.1 cyborg-conductor 14.0.0-3+deb13u1build0.25.10.1 python3-cyborg 14.0.0-3+deb13u1build0.25.10.1 In general, a standard system update will make all the necessary changes.

CVE-2026-40213, CVE-2026-40214

Ubuntu Security Notice USN-8413-1

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in Cyborg API Affect Ubuntu Users Two critical vulnerabilities were discovered in the Cyborg API affecting Ubuntu 26.04 LTS and 25.10. The first vulnerability (CVE-2026-40214) allows authenticated users to delete Accelerator Requests (ARQs) linked to other projects, leading to cross-tenant denial of service. The second vulnerability (CVE-2026-40213) involves a permissive default policy that permits unauthorized actions, such as reprogramming FPGA bitstreams on compute nodes, for any request with a valid authentication token. These vulnerabilities were published on May 7, 2026, and users are advised to update their systems to mitigate the risks. Ubuntu Pro offers ten-year security coverage for affected packages. Immediate action is recommended to prevent potential exploitation. 2 sources 72

Extracted Entities

Ubuntu 26.04 LTS Cyborg Critical API Flaws Denial of Service USN-8413

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (2)

CWE Weaknesses (1)

Platforms (1)