OpenStack keystonemiddleware EUVD-2026-114191

Requires that the attacker already possess a valid OpenStack application credential that was created with access restrictions (the restricted-application-credential feature); the attack is performed by including a custom X-Service-Token header in an API request handled by keystonemiddleware before version 13.0.2. Limiting factors: exploitation is not anonymous (a credential must be held, matching CVSS PR:L), and the value of the attack is bounded by what elevated privileges the bypass yields relative to the credential's intended scope. The available sources do not state a special non-default configuration requirement beyond use of access-restricted application credentials, and no user interaction is required (UI:N). Affected: keystonemiddleware before 13.0.2; fixed in 13.0.2.

The NVD CVSS 3.1 score of 8.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) marks this as High severity: network-reachable, low attack complexity, no user interaction, with high confidentiality and integrity impact. The decisive qualifier is PR:L - exploitation is NOT anonymous. The attacker must already possess a valid application credential (specifically one that was deliberately created with access restrictions), so this is an authorization/privilege-escalation flaw (CWE-863, Incorrect Authorization) for an already-authenticated but deliberately-constrained principal, not a path to initial compromise. Cross-referencing the other signals: this is NOT in CISA KEV, so there is no confirmed active exploitation; no EPSS probability was supplied, so widespread-exploitation likelihood cannot be quantified from the input; and no public exploit or PoC reference is present in the data. The vuln.today decision label is 'this_week' (prioritize within the week, below act_now/emergency). Net assessment: a genuine priority for OpenStack operators who issue access-restricted application credentials and rely on those restrictions as a security boundary, because the vulnerability directly defeats that boundary - but the PR:L precondition and absence of any KEV/PoC/EPSS signal place it as a 'patch promptly' item rather than a drop-everything emergency.

An actor holding an OpenStack application credential that was intentionally created with access restrictions (limited to specific roles or operations) adds a custom X-Service-Token header to an API request. keystonemiddleware before 13.0.2 mishandles that header, causing the credential's access restrictions to be bypassed and granting the actor privileges beyond those the credential was scoped to. No public exploit code was identified in the available data; the exact triggering mechanics beyond the crafted X-Service-Token header are not detailed in the provided sources.