In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an…
Affects OpenStack keystonemiddleware deployments that use application credential access_rules or enforce token binding. Fixed in 10.9.2, 10.12.2, 12.0.1 and 13.0.2 for their release lines.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 10.12.2, 12.0.1, 13.0.2
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
OpenStack keystonemiddleware, the authentication middleware used by OpenStack services, is affected. An attacker holding an access-restricted application credential can bypass its restrictions by sending a crafted X-Service-Token header, which can lead to elevated privileges.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-restricted application credential may bypass those restrictions resulting in elevation of privileges.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- OpenStack keystonemiddleware
fixed in 10.12.2; From 11.0.0 · fixed in 12.0.1; From 13.0.0 · fixed in 13.0.2
References 3
bugs.launchpad.net
GitHub · openstack/keystonemiddleware
openwall.com
Questions about CVE-2026-115642
What does this mean?
By supplying a custom X-Service-Token header in a request, the endpoint limits set by application credential access_rules can be bypassed. This can result in elevated privileges equal to the credential owner's RBAC permissions.Source: openwall.com, bugs.launchpad.net
Am I affected, and how do I check?
Affected releases are those before 10.9.2, from 10.10.0 before 10.12.2, from 11.0.0 before 12.0.1, and from 13.0.0 before 13.0.2. The bug only matters in setups that use application credential access_rules or enforce token binding, so check the installed keystonemiddleware version and whether either setting is in use.Source: openwall.com, bugs.launchpad.net
What should I do about it?
Upgrade to the fixed release on the same line: 10.9.2, 10.12.2, 12.0.1 or 13.0.2.Source: openwall.com, bugs.launchpad.net
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data