Low Severity
CVE-2026-71195
Published: Oct 28, 2026
Offline Python detector for CVE-2026-71195 exposure in OpenStack Manila, with branch-aware rules, CSV/JSON inventories, and auditable reports.
# CVE-2026-71195 Detector
Python CLI and library for **offline release-exposure assessment** of OpenStack
Manila servers. The tool accepts a single release or CSV/JSON inventory and emits
auditable findings with source references, stable reason codes and input/rule hashes.
**This is an inventory detector, not a live authorization test.** It does not
authenticate to OpenStack, enumerate shares, retrieve foreign metadata, change
access rules, create backups or modify resources. Runtime uses only Python's
standard library and makes no network requests.
## Evidence and scope
Rules reviewed on **2026-10-27** use
[OSSA-2026-046](https://security.openstack.org/ossa/OSSA-2026-046.html) and the
[CNA record](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/71xxx/CVE-2026-71195.json).
The advisory distinguishes unauthorized public-share operations from a separate
export-location metadata lookup issue. Therefore, **absence of public shares is
not proof of immunity** when export-location metadata is used.
| Metadata | Value |
| --- | --- |
| CVE | CVE-2026-71195 |
| Software | OpenStack Manila server |
| Advisory | OSSA-2026-046 |
| CNA weakness | CWE-863, Incorrect Authorization |
| CVSS v3.1 | 9.9, Critical |
~~~text
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
~~~
| Inclusive start | Exclusive end |
| --- | --- |
| 1.0.0 | 20.0.3 |
| 21.0.0 | 21.0.3 |
| 22.0.0 | 22.0.2 |
| 23.0.0 | 23.0.1 |
The advisory expresses the final interval as exactly 23.0.0. The CNA interval is
equivalent for stable three-component versions accepted here. Outside the recorded
intervals, the CNA default is unaffected.
A match identifies an affected software release, not observed exploitation.
This independent project is not affiliated with OpenStack.
## Provenance and exposure model
Supported products are `manila-upstream` and `OpenStack Manila upstream`.
Their use explicitly asserts an unmodified upstream **server** release.
Matching ignores case and collapses product