{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/keystonemiddleware-10.9.2-10.10.0-10.12.2-11.0.0-12.0.1-13.0.0-13.0.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:openstack:keystonemiddleware:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-115642"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["keystonemiddleware (\u003c10.9.2, \u003e=10.10.0 \u003c10.12.2, \u003e=11.0.0 \u003c12.0.1, \u003e=13.0.0 \u003c13.0.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["OpenStack"],"content_html":"\u003cp\u003eA vulnerability (CVE-2026-115642) exists in the OpenStack keystonemiddleware component. The flaw allows an attacker to bypass established access_rules by manipulating the X-Service-Token header, leading to unauthorized access to restricted resources. Affected versions include those \u0026lt;10.9.2, 10.10.0-10.12.1, 11.0.0-12.0.0, and 13.0.0-13.0.1.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the bypass of access control restrictions, potentially exposing sensitive OpenStack service resources to unauthorized entities.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade OpenStack keystonemiddleware to a patched version (\u0026gt;=10.9.2, \u0026gt;=10.12.2, \u0026gt;=12.0.1, or \u0026gt;=13.0.2).\u003c/li\u003e\n\u003cli\u003eReview OpenStack logs for requests containing anomalous X-Service-Token headers targeting sensitive endpoints.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T15:29:07Z","date_published":"2026-10-29T15:29:07Z","id":"https://feed.craftedsignal.io/briefs/2026-10-openstack-keystonemiddleware-bypass/","summary":"A vulnerability in OpenStack keystonemiddleware allows attackers to bypass access_rules using a malicious X-Service-Token, resulting in unauthorized access to restricted resources.","title":"OpenStack keystonemiddleware: Access control bypass via X-Service-Token (CVE-2026-115642)","url":"https://feed.craftedsignal.io/briefs/2026-10-openstack-keystonemiddleware-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Keystonemiddleware (\u003c10.9.2, \u003e=10.10.0 \u003c10.12.2, \u003e=11.0.0 \u003c12.0.1, \u003e=13.0.0 \u003c13.0.2)","version":"https://jsonfeed.org/version/1.1"}