OpenStack Cyborg prior to version 16.0.1 employs a default policy rule that authorizes any request possessing a valid Keystone token, without evaluating the user’s role, project membership, or scope. This unconditional allowance enables an authenticated user who has no role assignments to carry out privileged operations, such as reprogramming FPGA bitstreams on compute nodes through the agent RPC interface. The vulnerability stems from a misconfigured access control policy (CWE‑863) and can lead to significant loss of integrity and control over infrastructure components.

The affected system is OpenStack Cyborg, a project within the OpenStack ecosystem. All releases older than 16.0.1 inherit the default permissive policy and are therefore vulnerable.

The CVSS score of 7.4 categorizes this flaw as high severity. Although the EPSS score is not available, the lack of a KEV listing indicates that the vulnerability is not in the current known exploited list, yet the possibility of exploitation remains. The likely attack vector is the public API; once an attacker obtains a valid token—such as through legitimate authentication—the exploit can proceed without further privilege checks. If additional network isolation of CPM endpoints is not in place, the risk of unintended hardware reprogramming rises.