CVE-2026-93860CWE-862broken-access-control

CVE-2026-93860

published October 8, 2026

CVSS
7.1
EPSS
0%
Percentile
26.6
In the wild
Unconfirmed
What it is

In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any policy enforcement. Any holder of a valid Mistral token, regardless of assigned role, can read and change the service's cluster-wide maintenance state. Setting the state to PAUSED stops processing of new workflow and execution objects across all tenant projects until an operator restores it.

The record
Technical detail
CVSS
7.1 · NONE
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00343 · 26.6th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-10-08T22:18Z
References (3)
https://launchpad.net/bugs/2162789 · [email protected]https://security.openstack.org/ossa/OSSA-2026-044.html · [email protected]https://bugs.launchpad.net/ossa/+bug/2162789 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 10 OCT 03:32Z
    EPSS moved — → 0%
    epss
  • 08 OCT 17:35Z
    In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any…
    cvelistv5
  • 08 OCT 17:35Z
    In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any…
    cvelistv5