Zero Radar
← feed
HighVulnerabilityCVE-2026-115642updated 30 Oct 2026, 21:26 UTC

OpenStack keystonemiddleware lets restricted credentials bypass their limits

A flaw in a component that checks who is allowed to do what in OpenStack cloud software could let a restricted login gain more power than it was given. Someone holding a limited application credential might be able to do things they should

Fix available · out Official, 3 sources
SeverityHighCVSS 8.3 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yeskeystonemiddleware 13.0.2 or later; fixed releases for the 10.x and 11.x lines are referenced in the OpenStack advisory OSSA-2026-050 · since 30 Oct 2026
How sure is this?Official, 3 sourcesBacked by an official source

How the attack works simplified

  1. 1Restricted credential holderHas an application credential with limited access
  2. 2Crafted requestAdds a custom X-Service-Token header
  3. 3Middleware checkkeystonemiddleware skips access_rules enforcement
  4. 4Protected APIAction runs beyond the credential's rights
  5. ResultRestricted credential gains elevated privileges

What happened

In OpenStack keystonemiddleware, supplying a custom X-Service-Token header in a request lets a holder of an access-restricted application credential bypass the access_rules restrictions, resulting in privilege escalation.

Why it is dangerous: Organizations running OpenStack clouds could have restricted application credentials used to perform actions beyond their intended scope, which can lead to unauthorized changes to cloud resources.

Are you affected?

You are affected if you run OpenStack keystonemiddleware versions 10.10.0 through before the fixed release in the affected lines, 11.0.0 through before the fixed release, or 13.0.0 before 13.0.2, and use access-restricted application credentials with access_rules.

keystonemiddleware 10.10.0 up to (not including) the fixed 10.x release; keystonemiddleware 11.0.0 up to (not including) the fixed 11.x release; keystonemiddleware 13.0.0 up to (not including) 13.0.2

What to do

  1. Upgrade keystonemiddleware to 13.0.2 or later, or to the fixed release for your branch as listed in OSSA-2026-050
  2. Review application credentials that use access_rules and rotate any that may have been exposed
  3. Check Keystone and service logs for unusual use of X-Service-Token headers

Timeline

  1. 29 Oct 2026, 14:56 UTC
    Publicly disclosed
  2. 29 Oct 2026, 14:56 UTC
    Reported by oss-security · oss-security
  3. 29 Oct 2026, 15:00 UTC
    Picked up by Zero Radar
  4. 30 Oct 2026, 17:19 UTC
    NVD reported on it · NVD
  5. 30 Oct 2026, 21:26 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 3 reports, oldest first

Official vendor, government CERT or advisory database

Security researchers research teams and mailing lists

Technical details

ID
CVE-2026-115642 · GHSA-ghh7-5q3h-mc48
CVSS
8.3 / 10
Disclosed
29 Oct 2026, 14:56 UTC
On Zero Radar
29 Oct 2026, 15:00 UTC (5 min after disclosure)
Last change
30 Oct 2026, 21:26 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

OpenStack keystonemiddleware lets restricted credentials bypass their limits · Zero Radar