CVE-2026-23989: 
vulnerability analysis and mitigation

CVE-2026-23989 is a public link scope bypass vulnerability in the REVA component of OpenCloud, an interoperability platform for cloud storage. A bug in the GRPC authorization middleware allows a malicious user to bypass scope verification of a public link and, via the archiver service, download all resources accessible to the public link creator as a zip or tar archive. Affected versions include all releases up to and including 2.40.1 and versions 2.41.0 through 2.42.2. The vulnerability was published on February 5, 2026, and has a CVSS v3.1 base score of 8.2 (High) (Github Advisory, OpenCloud Advisory).

The root cause is an incorrect authorization check (CWE-863) combined with a path traversal weakness (CWE-22) in the checkIfNestedResource function within internal/grpc/interceptors/auth/scope.go. The original code used strings.HasPrefix(childPath, parentPath) to verify that a requested resource was within the public link's scope, which could be bypassed by crafting a path that passed the prefix check but resolved outside the intended directory. The fix replaced this with filepath.Rel() and a check that the relative path does not begin with .., preventing directory traversal-style scope escapes. Exploitation is only possible through the archiver service (not standard WebDAV requests), and requires the attacker to have access to a valid public link token (Github Advisory, Patch Commit).

Successful exploitation allows an attacker with access to any public link to exfiltrate all files and directories accessible to the user who created that public link, packaged as a zip or tar archive. This results in a high confidentiality impact, as sensitive data beyond the intended share scope can be downloaded without authorization. Integrity is also considered impacted per the CVSS scoring, though the primary risk is unauthorized data disclosure. Availability is not affected (Github Advisory, OpenCloud Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.019% (5th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Github Advisory).

1. Obtain a public link: Acquire any valid public link token for an OpenCloud instance running a vulnerable version of Reva (≤ 2.40.1 or 2.41.0–2.42.2). This could be a link shared publicly or obtained through social engineering.
2. Identify the archiver service endpoint: Locate the OpenCloud archiver service API endpoint (typically exposed as part of the OpenCloud deployment, e.g., /archiver or similar).
3. Craft a malicious archiver request: Using the public link token for authentication, send a request to the archiver service that references resources outside the intended public link scope by manipulating the resource path (exploiting the flawed strings.HasPrefix parent path check in the GRPC authorization middleware).
4. Bypass scope verification: The vulnerable checkIfNestedResource function incorrectly validates the path, allowing the crafted request to pass authorization checks for resources outside the share scope.
5. Download the archive: The archiver service generates and returns a zip or tar file containing all resources accessible to the public link creator, enabling full data exfiltration beyond the intended share boundary (OpenCloud Advisory, Patch Commit).

• Network: Unusual or repeated HTTP requests to the archiver service endpoint using public link tokens, especially requests referencing paths outside the shared resource's directory; large archive file downloads (zip/tar) initiated via public link authentication.
• Logs: Archiver service access logs showing requests with public link tokens accessing resource paths that do not correspond to the shared file or directory; GRPC middleware logs indicating scope check evaluations for out-of-scope resources.
• File System: Unexpected large archive files (zip or tar) generated or downloaded from the server, particularly during off-hours or from unfamiliar IP addresses.

Update OpenCloud Reva to version 2.40.3 (for 2.40.x deployments) or 2.42.3 (for 2.41.x deployments) to apply the fix. There is no standalone workaround for Reva itself; however, the OpenCloud project advisory may provide deployment-level configuration mitigations for OpenCloud environments. Administrators should also review archiver service access logs for suspicious activity and consider restricting public link sharing policies to limit exposure until patching is complete (Github Advisory, OpenCloud Advisory).

The vulnerability was coordinated and disclosed by the OpenCloud security team, with credits to researchers rhafer (finder), aduffeck (remediation developer), dragotin (coordinator), and micbar (coordinator). A brief mention appeared on Bluesky shortly after disclosure. SUSE issued related package updates (govulncheck/vulndb) referencing this CVE. No significant broader media coverage or notable independent researcher commentary has been identified (OpenCloud Advisory).