Skip to main content

OpenStack Mistral EUVDEUVD-2026-95129

| CVE-2026-93860 HIGH
Missing Authorization (CWE-862)
2026-10-08 mitre GHSA-858j-2m97-g3qm
7.1
CVSS 4.0 · Vendor: mitre
Share

Severity by source

Vendor (mitre) PRIMARY
7.1 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.5 MEDIUM

Any valid token suffices so PR:L and AC:L over the network (AV:N); impact is availability-only cluster DoS (A:H) with no data read/modify, so C:N/I:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Oct 08, 2026 - 19:18 EUVD
Analysis Generated
Oct 08, 2026 - 18:17 vuln.today
CVE Published
Oct 08, 2026 - 17:35 cve.org
HIGH 7.1

DescriptionCVE.org

In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any policy enforcement. Any holder of a valid Mistral token, regardless of assigned role, can read and change the service's cluster-wide maintenance state. Setting the state to PAUSED stops processing of new workflow and execution objects across all tenant projects until an operator restores it.

AnalysisAI

Cluster-wide denial of service in OpenStack Mistral (all versions through 23.0.0) lets any authenticated holder of a valid Mistral token - regardless of role or tenant - read and alter the service's global maintenance state through the /v2/maintenance API, because the controller clears the request context and calls the maintenance service without any policy enforcement. Setting the state to PAUSED halts processing of new workflow and execution objects for every tenant project until an operator intervenes, giving a lowest-privileged tenant member a persistent, cross-tenant availability impact (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 7.1 High; NVD's CVSS 4.0 vector scores identically at 7.1 High). …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden

Vulnerability AssessmentAI

Exploitation Exploitable against default configurations: no special feature flag or non-default setting is required - the /v2/maintenance controller unconditionally clears the request context and invokes the maintenance service without policy enforcement. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The input CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H) scores 7.1 (High) and is internally consistent with the description: network-reachable, low attack complexity, requires low privileges (any valid Mistral token), no user interaction, and an availability-only impact (VA:H; VC/VI:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation No vendor-released patched version is identified in the available data, so the first remediation step is to track OSSA-2026-044 (https://security.openstack.org/ossa/OSSA-2026-044.html) and Launchpad bug 2162789 (https://launchpad.net/bugs/2162789) for the fixed release and then upgrade Mistral to that version; upstream fix availability should be treated as 'not independently confirmed' until a tagged release or commit appears in those references. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, confirm whether Mistral is deployed and at which version (all versions through 23.0.0 are affected), and immediately restrict access to the /v2/maintenance API so that only trusted administrative source networks or identities can reach it, using reverse-proxy, API gateway or network ACL rules at the Mistral endpoint; simultaneously enable alerting on any change to Mistral's global maintenance state and confirm the on-call runbook to reset the service from PAUSED back to ACTIVE. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

CVE-2016-6662 CRITICAL POC
9.8 Sep 20

Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.2

CVE-2013-2121 MEDIUM POC
6.0 Jul 31

Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote

CVE-2013-2113 MEDIUM POC
6.0 Jul 31

The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users w

CVE-2018-3639 MEDIUM POC
5.5 May 22

Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addres

CVE-2015-3456 HIGH POC
7.7 May 13

The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a

CVE-2018-11218 CRITICAL POC
9.8 Jun 17

Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10,

CVE-2015-8914 CRITICAL POC
9.1 Jun 17

The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an int

CVE-2024-28718 CRITICAL POC
9.8 Apr 12

An issue in OpenStack magnum yoga-eom version allows a remote attacker to execute arbitrary code via the cert_manager.py

CVE-2018-11219 CRITICAL POC
9.8 Jun 17

An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4

CVE-2017-1000366 HIGH POC
7.8 Jun 19

glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causin

CVE-2015-7512 CRITICAL
9.0 Jan 08

Buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU, when a guest NIC has a larger MTU, allows remot

CVE-2026-28370 CRITICAL POC
9.1 Feb 27

Code injection in OpenStack Vitrage query parser allows authenticated users to execute arbitrary Python code through cra

Share

EUVD-2026-95129 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy