Live › vulnerability › CVE-2026-115642
keystonemiddleware, the OpenStack authentication middleware, trusts a custom X-Service-Token header supplied by the request. An attacker holding a restricted application credential can use that header to skip the credential's limits and gain higher privileges.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 17:31 UTC. All times on this page are UTC.
OpenStack deployments that run services using keystonemiddleware below 13.0.2 and issue access-restricted application credentials. Attackers need one of those credentials first, so deployments that do not use restricted application credentials face less risk. Deployments on managed clouds should confirm with the provider whether their services are patched.
No product ranges from the sources yet.
pip show keystonemiddleware on each OpenStack service host.13.0.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-restricted application credential may bypass those restrictions resulting in elevation of privileges.
This page as .md · .json · in your agent: get_signal("CVE-2026-115642")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.