{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-115642", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-10-23T03:35:02.810Z", "datePublished": "2026-10-30T16:23:23.404Z", "dateUpdated": "2026-10-30T16:54:30.773Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "keystonemiddleware", "programFiles": ["keystonemiddleware/auth_token/__init__.py"], "repo": "https://opendev.org/openstack/keystonemiddleware", "vendor": "OpenStack", "versions": [{"lessThan": "10.12.2", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "12.0.1", "status": "affected", "version": "11.0.0", "versionType": "semver"}, {"lessThan": "13.0.2", "status": "affected", "version": "13.0.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-restricted application credential may bypass those restrictions resulting in elevation of privileges."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-10-30T16:23:23.404Z"}, "references": [{"url": "https://bugs.launchpad.net/keystonemiddleware/+bug/2162748"}, {"url": "https://github.com/openstack/keystonemiddleware/tags"}, {"url": "https://www.openwall.com/lists/oss-security/2026/10/29/2"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:openstack:keystonemiddleware:*:*:*:*:*:*:*:*", "versionEndExcluding": "10.12.2"}, {"vulnerable": true, "criteria": "cpe:2.3:a:openstack:keystonemiddleware:*:*:*:*:*:*:*:*", "versionStartIncluding": "11.0.0", "versionEndExcluding": "12.0.1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:openstack:keystonemiddleware:*:*:*:*:*:*:*:*", "versionStartIncluding": "13.0.0", "versionEndExcluding": "13.0.2"}]}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-30T16:54:22.630767Z", "id": "CVE-2026-115642", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T16:54:30.773Z"}}]}}

{}

{}

{"acknowledgement": "Upstream acknowledges Nassim Abbaoui (OVHcloud) as the original reporter.", "bugzilla": {"description": "keystonemiddleware: keystonemiddleware: application credential access_rules bypass via X-Service-Token header presence check", "id": "2559580", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559580"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "status": "draft"}, "cwe": "CWE-863", "details": ["A flaw was found in OpenStack keystonemiddleware and Keystone. The code incorrectly treats the presence of the X-Service-Token HTTP header as sufficient to skip enforcement of application credential access rules (and can skip related token-binding checks). An attacker who holds an application credential with access_rules can bypass those restrictions by sending any non-empty X-Service-Token value; a valid service token is not required for this bypass when delay_auth_decision is enabled (typical). This allows API calls beyond what the credential was designed to permit within the attacker's existing roles. Only installing fixed keystonemiddleware and Keystone packages remediates the issue."], "mitigation": {"lang": "en:us", "value": "No mitigation is currently available that meets Red Hat Product Security standards for a complete fix."}, "name": "CVE-2026-115642", "package_state": [{"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift4/ose-ironic-rhel9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "python-keystonemiddleware", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Affected", "package_name": "openshift5/ose-ironic-rhel9", "product_name": "Red Hat OpenShift Container Platform 5"}, {"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Affected", "package_name": "python-keystonemiddleware", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Affected", "package_name": "python-keystonemiddleware", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Affected", "package_name": "python-keystonemiddleware", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Affected", "package_name": "python-keystonemiddleware", "product_name": "Red Hat OpenStack Platform 18.0"}], "public_date": "2026-10-29T15:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-115642\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-115642\nhttps://launchpad.net/bugs/2162748"], "statement": "Red Hat OpenStack Platform and Red Hat OpenShift ship python-keystonemiddleware and openstack-keystone in multiple streams. The same access_rules bypass (header presence of X-Service-Token rather than validated service token) exists in keystonemiddleware auth_token middleware and in Keystone's own API code path; both require fixes. Any project member who can create an application credential with access_rules can bypass those rules by sending any non-empty X-Service-Token value on API requests when the service uses delay_auth_decision (common). There is no supported configuration-only workaround; apply upstream patches for keystonemiddleware and Keystone. Keystone may disclose separately from the 2026-10-29 keystonemiddleware coordinated release.", "threat_severity": "Important"}