The vulnerability allows a non‑admin user with a project‑scoped 'member' or 'reader' role to call the Cinder Message listing API and receive non‑expired messages for other projects. The messages include UUIDs of resources owned by those projects, exposing identifiers that can be used in further reconnaissance. This is an information exposure flaw (CWE‑201) that leaks cross‑project data. Because the disclosed data are generic messages sanitized for other projects, the immediate impact is a moderate confidentiality compromise, reflected in a CVSS score of 4.3.

All OpenStack Cinder deployments up to version 29.0.0 are affected. The flaw resides in the Messages API and is present in every instance of Cinder that uses the v3.3 API until the bug is fixed in a later release. The provided CPE string confirms that any Cinder service matches the affected pattern.

The CVSS score of 4.3 indicates a moderate seriousness, and the EPSS score of less than 1% suggests that it is unlikely to see widespread exploitation at present. The vulnerability is already known and listed by advisories but is not part of the CISA KEV catalog, implying that there is no documented exploit in the wild. Attackers would need access to the API as a non‑admin, which is typically possible for legitimate users, meaning that exploitation is feasible but requires only routine API calls.