The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the     caller owns the share. The API controllers authorize operations against the caller's own project context,     then load a foreign public share without re-authorizing against the share's actual owner. This affects the     following operations: allow_access: grant data-plane read/write access to another tenant's share;
    deny_access: revoke the owner's existing access rules; update_access: escalate access level (e.g., ro to     rw); create_share_backup: exfiltrate share data via a backup created under the attacker's project;
    soft_delete: move a foreign share to the recycle bin; restore: interfere with the owner's deletion     workflow; export location metadata: create, update, and delete metadata on foreign export locations;
    access rule listing: disclose IPs, usernames, and CephFS keys. Any authenticated project member can     exploit these operations on any public share. The share UUID is visible since the share is public.
    (CVE-2026-71195)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-71195

critical Nessus Plugin ID 369001

Version 1.3