OpenStack keystonemiddleware flaw allows bypass of access restrictions (EUVD-2026-114191)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- OpenStack
- Product
- keystonemiddleware
- First seen
Summary
A vulnerability entry in the EU Vulnerability Database (EUVD-2026-114191) describes an access-restriction bypass in OpenStack keystonemiddleware before 13.0.2, scored 8.3/10 (CVSS v3.1). The entry says a custom X-Service-Token header lets anyone holding an access-restricted application credential bypass those restrictions.
If you use OpenStack
Upgrade keystonemiddleware to version 13.0.2 or later
Review application credentials that use access restrictions
Check service logs for requests carrying a custom X-Service-Token header
Follow the EUVD-2026-114191 entry for updates
Review application credentials that have access restrictions applied
Audit recent requests for unusual X-Service-Token headers
What the sources say 2
· Mastodon: “In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-restricted application credential may bypass those restrictions” Source
· Mastodon: “In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-restricted application credential may bypass those restrictions resulting in elevation of privileges.” Source