CVE-2026-93860
published 2026-10-08CVE-2026-93860: In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any…
PriorityP340high7.1CVSS 4.0
AVNACLATNPRLUINVCNVINVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.34%
26.6th percentile
In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any policy enforcement. Any holder of a valid Mistral token, regardless of assigned role, can read and change the service's cluster-wide maintenance state. Setting the state to PAUSED stops processing of new workflow and execution objects across all tenant projects until an operator restores it.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openstack | mistral | < 20.1.1 | 20.1.1 |
| openstack | mistral | — | — |
| openstack | mistral | >= 21.0.0 < 21.0.1 | 21.0.1 |
| openstack | mistral | >= 22.0.0 < 22.0.1 | 22.0.1 |
| redhat | openstack-mistral | — | — |
CVSS provenance
nvdv4.07.1HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
openstack-mistral: mistral: Unauthenticated-project user can trigger global maintenance mode causing cross-tenant denial of service
vendor_redhat·2026-10-08·CVSS 7.1
CVE-2026-93860 [HIGH] CWE-862 openstack-mistral: mistral: Unauthenticated-project user can trigger global maintenance mode causing cross-tenant denial of service
openstack-mistral: mistral: Unauthenticated-project user can trigger global maintenance mode causing cross-tenant denial of service
A flaw was found in OpenStack Mistral. The maintenance API endpoint is missing an authorization check, allowing any authenticated user to activate global maintenance mode on the Mistral service. When an attacker triggers maintenance mode, all write operations (workflow execution creation, environment creation, and similar API calls) are blocked across all tenant projects on the affected Mistral deployment. This results in a denial of service for all tenants until an administrator or the attacker restores normal operation.
Statement: Red Hat product impact analysis pending. Component mapping is required to determine which Red Hat OpenStack Platform (RHOSP) re
GHSA
In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any policy enforcement.
ghsa_unreviewed·2026-10-08
CVE-2026-93860 [HIGH] CWE-862 In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any policy enforcement.
In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any policy enforcement. Any holder of a valid Mistral token, regardless of assigned role, can read and change the service's cluster-wide maintenance state. Setting the state to PAUSED stops processing of new workflow and execution objects across all tenant projects until an operator restores it.
No detection rules found.
No public exploits indexed.
2026-10-08
Published