{"id":"CVE-2026-93860","aliases":["DEBIAN-CVE-2026-93860","EUVD-2026-95129","GHSA-858j-2m97-g3qm","UBUNTU-CVE-2026-93860"],"status":"published","title":"In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request...","description":"In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any policy enforcement. Any holder of a valid Mistral token, regardless of assigned role, can read and change the service's cluster-wide maintenance state. Setting the state to PAUSED stops processing of new workflow and execution objects across all tenant projects until an operator restores it.","severity":{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00414,"percentile":0.36218,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-862"],"published":"2026-10-08T17:35:43Z","modified":"2026-11-04T20:04:28Z","fixes":[{"ecosystem":"Debian:14","package":"mistral","fixed_in":["23.0.0-2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"mistral","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["15.0.0-1","15.0.0-1+deb12u1","16.0.0-1","16.0.0-2","16.0.0-3","16.0.0-4","16.0.0~rc1-1","17.0.0-1","17.0.0-2","17.0.0-3","17.0.0~rc1-1","18.0.0~rc1-1","18.0.1-1","19.0.0-1","19.0.0-2","19.0.0~rc1-1","19.0.0~rc1-2","20.0.0-1","20.0.0-2","20.0.0~rc1-1","20.0.0~rc1-2","21.0.0-1","21.0.0-2","21.0.0-4","21.0.0-5","21.0.0-6","21.0.0~rc1-1","21.0.0~rc1-2","22.0.0-1","22.0.0-3","22.0.0~rc1-1","22.0.0~rc1-2","22.0.0~rc1-3","23.0.0-1","23.0.0-2","23.0.0~rc1-1","23.0.0~rc1-2"]},{"source":"osv","ecosystem":"Debian:13","package":"mistral","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20.0.0-2","20.0.0-2+deb13u1","21.0.0-1","21.0.0-2","21.0.0-4","21.0.0-5","21.0.0-6","21.0.0~rc1-1","21.0.0~rc1-2","22.0.0-1","22.0.0-3","22.0.0~rc1-1","22.0.0~rc1-2","22.0.0~rc1-3","23.0.0-1","23.0.0-2","23.0.0~rc1-1","23.0.0~rc1-2"]},{"source":"osv","ecosystem":"Debian:14","package":"mistral","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.0-2"}]}],"versions":["20.0.0-2","21.0.0-1","21.0.0-2","21.0.0-4","21.0.0-5","21.0.0-6","21.0.0~rc1-1","21.0.0~rc1-2","22.0.0-1","22.0.0-3","22.0.0~rc1-1","22.0.0~rc1-2","22.0.0~rc1-3","23.0.0-1","23.0.0~rc1-1","23.0.0~rc1-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"mistral","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.0-1","1.0.0-4","2.0.0~b3-3","2.0.0~rc1-1","2.0.0~rc2-1","2.0.0-1","2.0.0-1ubuntu2","2.0.0-1ubuntu2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"mistral","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-0ubuntu1","6.0.0~b1-0ubuntu1","6.0.0~b1-0ubuntu2","6.0.0~b2-0ubuntu1","6.0.0~rc1-0ubuntu1","6.0.0-0ubuntu1","6.0.0-0ubuntu1.1","6.0.0-0ubuntu1.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mistral","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["13.0.0-0ubuntu1","13.0.0+git2021120910.b2d6de56-0ubuntu1","13.0.0+git2022030313.55bb2564-0ubuntu1","14.0.0-0ubuntu1","14.0.0-0ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"mistral","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["17.0.0-0ubuntu1","18.0.0~rc1-0ubuntu1","18.0.1-0ubuntu1","18.0.1-0ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"mistral","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["22.0.0-0ubuntu1","22.0.0-0ubuntu2","22.0.0+git20260814.61.b4aeb55-0ubuntu1","23.0.0~rc1-0ubuntu1","23.0.0-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"mistral","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.0.0-0ubuntu1","21.0.0+git20260106.10.420677c8-0ubuntu1","22.0.0-0ubuntu1","22.0.0-0ubuntu1.1"]}],"products":[{"vendor":"openstack","product":"mistral"}],"references":[{"url":"https://launchpad.net/bugs/2162789","tags":["issue-tracking","report"]},{"url":"https://security.openstack.org/ossa/OSSA-2026-044.html","tags":["web","report"]},{"url":"https://bugs.launchpad.net/ossa/+bug/2162789","tags":["exploit","evidence","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93860","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-858j-2m97-g3qm"},{"url":"https://opendev.org/openstack/mistral","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93860.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-93860","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-93860","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-93860","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-93860","description":"In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any policy enforcement. Any holder of a valid Mistral token, regardless of assigned role, can read and change the service's cluster-wide maintenance state. Setting the state to PAUSED stops processing of new workflow and execution objects across all tenant projects until an operator restores it.","status":"published","published":"2026-10-08T17:35:43.653Z","modified":"2026-10-09T11:42:46.119Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:19:54.122945Z"}],"euvd":[{"id":"EUVD-2026-95129","description":"In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any policy enforcement. Any holder of a valid Mistral token, regardless of assigned role, can read and change the service's cluster-wide maintenance state. Setting the state to PAUSED stops processing of new workflow and execution objects across all tenant projects until an operator restores it.","status":"published","published":"2026-10-08T17:35:43Z","modified":"2026-10-09T11:42:46Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:27:25.459601Z"}],"ghsa":[{"id":"GHSA-858j-2m97-g3qm","title":"In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request...","description":"In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any policy enforcement. Any holder of a valid Mistral token, regardless of assigned role, can read and change the service's cluster-wide maintenance state. Setting the state to PAUSED stops processing of new workflow and execution objects across all tenant projects until an operator restores it.","status":"published","published":"2026-10-08T18:32:30Z","modified":"2026-10-09T12:32:42Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:13:00.589729Z"}],"nvd":[{"id":"CVE-2026-93860","description":"In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any policy enforcement. Any holder of a valid Mistral token, regardless of assigned role, can read and change the service's cluster-wide maintenance state. Setting the state to PAUSED stops processing of new workflow and execution objects across all tenant projects until an operator restores it.","status":"published","published":"2026-10-08T18:18:30.993Z","modified":"2026-10-09T12:17:13.113Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:55.142936Z"}],"osv":[{"id":"CVE-2026-93860","description":"In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any policy enforcement. Any holder of a valid Mistral token, regardless of assigned role, can read and change the service's cluster-wide maintenance state. Setting the state to PAUSED stops processing of new workflow and execution objects across all tenant projects until an operator restores it.","status":"published","published":"2026-10-08T17:35:43.653Z","modified":"2026-10-28T02:31:07.361064569Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:45:20.931171Z"},{"id":"DEBIAN-CVE-2026-93860","description":"In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any policy enforcement. Any holder of a valid Mistral token, regardless of assigned role, can read and change the service's cluster-wide maintenance state. Setting the state to PAUSED stops processing of new workflow and execution objects across all tenant projects until an operator restores it.","status":"published","published":"2026-10-08T18:18:30.993Z","modified":"2026-10-13T05:00:13.393824965Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:46:06.846102Z"},{"id":"UBUNTU-CVE-2026-93860","description":"In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any policy enforcement. Any holder of a valid Mistral token, regardless of assigned role, can read and change the service's cluster-wide maintenance state. Setting the state to PAUSED stops processing of new workflow and execution objects across all tenant projects until an operator restores it.","status":"published","published":"2026-10-08T18:18:00Z","modified":"2026-11-04T20:04:28.667558698Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-04T21:43:26.87909Z"}]}}