Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Any valid token suffices so PR:L and AC:L over the network (AV:N); impact is availability-only cluster DoS (A:H) with no data read/modify, so C:N/I:N.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any policy enforcement. Any holder of a valid Mistral token, regardless of assigned role, can read and change the service's cluster-wide maintenance state. Setting the state to PAUSED stops processing of new workflow and execution objects across all tenant projects until an operator restores it.
AnalysisAI
Cluster-wide denial of service in OpenStack Mistral (all versions through 23.0.0) lets any authenticated holder of a valid Mistral token - regardless of role or tenant - read and alter the service's global maintenance state through the /v2/maintenance API, because the controller clears the request context and calls the maintenance service without any policy enforcement. Setting the state to PAUSED halts processing of new workflow and execution objects for every tenant project until an operator intervenes, giving a lowest-privileged tenant member a persistent, cross-tenant availability impact (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 7.1 High; NVD's CVSS 4.0 vector scores identically at 7.1 High). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitable against default configurations: no special feature flag or non-default setting is required - the /v2/maintenance controller unconditionally clears the request context and invokes the maintenance service without policy enforcement. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The input CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H) scores 7.1 (High) and is internally consistent with the description: network-reachable, low attack complexity, requires low privileges (any valid Mistral token), no user interaction, and an availability-only impact (VA:H; VC/VI:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patched version is identified in the available data, so the first remediation step is to track OSSA-2026-044 (https://security.openstack.org/ossa/OSSA-2026-044.html) and Launchpad bug 2162789 (https://launchpad.net/bugs/2162789) for the fixed release and then upgrade Mistral to that version; upstream fix availability should be treated as 'not independently confirmed' until a tagged release or commit appears in those references. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm whether Mistral is deployed and at which version (all versions through 23.0.0 are affected), and immediately restrict access to the /v2/maintenance API so that only trusted administrative source networks or identities can reach it, using reverse-proxy, API gateway or network ACL rules at the Mistral endpoint; simultaneously enable alerting on any change to Mistral's global maintenance state and confirm the on-call runbook to reset the service from PAUSED back to ACTIVE. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.2
Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote
The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users w
Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addres
The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10,
The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an int
An issue in OpenStack magnum yoga-eom version allows a remote attacker to execute arbitrary code via the cert_manager.py
An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4
glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causin
Buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU, when a guest NIC has a larger MTU, allows remot
Code injection in OpenStack Vitrage query parser allows authenticated users to execute arbitrary Python code through cra
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today
EUVD-2026-95129
GHSA-858j-2m97-g3qm