OpenStack Cinder

• CVE-2026-93856 Medium 4.3 In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API. A non-admin user with the project-scoped 'member' or 'reader' role making the Block Storage API 0.4%