{"id":"CVE-2026-115642","kind":"vulnerability","aliases":["CVE-2026-115642"],"related":[],"title":"OpenStack keystonemiddleware: forged service token header bypasses application credential restrictions","description":"In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-restricted application credential may bypass those restrictions resulting in elevation of privileges.","summary":"keystonemiddleware, the OpenStack authentication middleware, trusts a custom X-Service-Token header supplied by the request. An attacker holding a restricted application credential can use that header to skip the credential's limits and gain higher privileges.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["keystone","openstack","package","self-hosted"],"not_affected_if":["keystonemiddleware-13.0.2-or-later","no-restricted-application-credentials"],"how_to_check":"- Check the installed keystonemiddleware version with `pip show keystonemiddleware` on each OpenStack service host.\n- Check whether any application credentials are restricted with access rules in Keystone.","fix":"- keystonemiddleware: move to `13.0.2` or later.","status":"open","published_at":"2026-10-30T17:17:15+00:00","first_seen_at":"2026-10-30T17:31:39+00:00","triaged_at":"2026-10-30T17:32:01+00:00","updated_at":"2026-10-30T17:32:01+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T17:32:01Z","model":"claude-haiku-5-5","output":{"fix":"- keystonemiddleware: move to `13.0.2` or later.","reach":"network","title":"OpenStack keystonemiddleware: forged service token header bypasses application credential restrictions","impact":"high","summary":"keystonemiddleware, the OpenStack authentication middleware, trusts a custom X-Service-Token header supplied by the request. An attacker holding a restricted application credential can use that header to skip the credential's limits and gain higher privileges.","audience":"businesses","category":"package","nicknames":[],"who_cares":["openstack","keystone","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"attacker escalates privileges beyond restricted application credential limits","analyst_note":"","how_to_check":"- Check the installed keystonemiddleware version with `pip show keystonemiddleware` on each OpenStack service host.\n- Check whether any application credentials are restricted with access rules in Keystone.","plain_action":"","needs_analyst":false,"not_affected_if":["keystonemiddleware-13.0.2-or-later","no-restricted-application-credentials"],"who_is_affected":"OpenStack deployments that run services using keystonemiddleware below 13.0.2 and issue access-restricted application credentials. Attackers need one of those credentials first, so deployments that do not use restricted application credentials face less risk. Deployments on managed clouds should confirm with the provider whether their services are patched.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000681,"input_tokens":4111,"output_tokens":539,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-115642':13A,16A '-2026':12A,15A '13.0.2':65C 'access':84C 'access-restrict':83C 'anyon':78C 'applic':8A,45B,86C 'attack':41B 'authent':26B 'bypass':7A,89C 'credenti':9A,46B,54B,87C 'custom':30B,69C 'cve':11A,14A 'elev':94C 'forg':3A 'gain':58B 'header':6A,35B,50B,74C 'higher':59B 'hold':42B 'host':22B 'keyston':17B 'keystonemiddlewar':2A,23B,63C 'limit':56B 'may':88C 'middlewar':27B 'openstack':1A,18B,25B,62C 'packag':19B 'possess':80C 'privileg':60B,96C 'request':39B,77C 'restrict':10A,44B,85C,91C 'result':92C 'self':21B 'self-host':20B 'servic':4A,33B,72C 'skip':52B 'suppli':36B,67C 'token':5A,34B,73C 'trust':28B 'use':48B 'x':32B,71C 'x-service-token':31B,70C","nicknames":[],"mitigations":[],"who_affected":"OpenStack deployments that run services using keystonemiddleware below 13.0.2 and issue access-restricted application credentials. Attackers need one of those credentials first, so deployments that do not use restricted application credentials face less risk. Deployments on managed clouds should confirm with the provider whether their services are patched.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T17:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115642","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115642","severity":null,"published_at":"2026-10-30T17:17:15+00:00","modified_at":"2026-10-30T17:17:15+00:00","first_seen_at":"2026-10-30T17:31:39+00:00","fetched_at":"2026-10-30T17:31:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}