high advisory October 29, 2026

OpenStack keystonemiddleware: Access control bypass via X-Service-Token (CVE-2026-115642)

A vulnerability in OpenStack keystonemiddleware allows attackers to bypass access_rules using a malicious X-Service-Token, resulting in unauthorized access to restricted resources.

Triage facts

Revision 1

Applicability: keystonemiddleware (<10.9.2, >=10.10.0 <10.12.2, >=11.0.0 <12.0.1, >=13.0.0 <13.0.2)
Evidence: Unknown
Severity: High
Action: Elevated
Sources: 1 public source
Freshness: Revision 1Oct 29, 15:29 UTC
Vulnerabilities: 1 CVE
Source quality: A1Likely

A vulnerability (CVE-2026-115642) exists in the OpenStack keystonemiddleware component. The flaw allows an attacker to bypass established access_rules by manipulating the X-Service-Token header, leading to unauthorized access to restricted resources. Affected versions include those <10.9.2, 10.10.0-10.12.1, 11.0.0-12.0.0, and 13.0.0-13.0.1.

Impact

Successful exploitation allows for the bypass of access control restrictions, potentially exposing sensitive OpenStack service resources to unauthorized entities.

Recommendation

Upgrade OpenStack keystonemiddleware to a patched version (>=10.9.2, >=10.12.2, >=12.0.1, or >=13.0.2).
Review OpenStack logs for requests containing anomalous X-Service-Token headers targeting sensitive endpoints.

Immediate actions

Upgrade keystonemiddleware to patched versions: 10.9.2, 10.12.2, 12.0.1, or 13.0.2.

IT Operations 48h

Threat Hunt

Identify anomalous X-Service-Token headers in OpenStack service logs.

T1190 medium medium confidence hunt now

Data: OpenStack Keystone / middleware access logs, HTTP header logs

Mitigations

Apply security patches or upgrade keystonemiddleware to versions >=10.9.2, >=10.12.2, >=12.0.1, or >=13.0.2.

immediate IT Operations

CVE-2026-115642