CVE-2026-93860

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-93860", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-09-18T19:12:29.649Z", "datePublished": "2026-10-08T17:35:43.653Z", "dateUpdated": "2026-10-09T11:42:46.119Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Mistral", "repo": "https://opendev.org/openstack/mistral", "vendor": "OpenStack", "versions": [{"lessThan": "20.1.1", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "21.0.1", "status": "affected", "version": "21.0.0", "versionType": "semver"}, {"lessThan": "22.0.1", "status": "affected", "version": "22.0.0", "versionType": "semver"}, {"status": "affected", "version": "23.0.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any policy enforcement. Any holder of a valid Mistral token, regardless of assigned role, can read and change the service's cluster-wide maintenance state. Setting the state to PAUSED stops processing of new workflow and execution objects across all tenant projects until an operator restores it."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 7.1, "baseSeverity": "HIGH", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "CWE-862 Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-10-08T17:35:43.653Z"}, "references": [{"tags": ["issue-tracking"], "url": "https://launchpad.net/bugs/2162789"}, {"url": "https://security.openstack.org/ossa/OSSA-2026-044.html"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}}, "adp": [{"references": [{"url": "https://bugs.launchpad.net/ossa/+bug/2162789", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-09T11:42:27.603968Z", "id": "CVE-2026-93860", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-09T11:42:46.119Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-93860", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-09T11:42:27.603968Z"}}}], "references": [{"url": "https://bugs.launchpad.net/ossa/+bug/2162789", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-09T11:42:40.438Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://opendev.org/openstack/mistral", "vendor": "OpenStack", "product": "Mistral", "versions": [{"status": "affected", "version": "0", "lessThan": "20.1.1", "versionType": "semver"}, {"status": "affected", "version": "21.0.0", "lessThan": "21.0.1", "versionType": "semver"}, {"status": "affected", "version": "22.0.0", "lessThan": "22.0.1", "versionType": "semver"}, {"status": "affected", "version": "23.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://launchpad.net/bugs/2162789", "tags": ["issue-tracking"]}, {"url": "https://security.openstack.org/ossa/OSSA-2026-044.html"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "descriptions": [{"lang": "en", "value": "In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any policy enforcement. Any holder of a valid Mistral token, regardless of assigned role, can read and change the service's cluster-wide maintenance state. Setting the state to PAUSED stops processing of new workflow and execution objects across all tenant projects until an operator restores it."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-10-08T17:35:43.653Z"}}}, "cveMetadata": {"cveId": "CVE-2026-93860", "state": "PUBLISHED", "dateUpdated": "2026-10-09T11:42:46.119Z", "dateReserved": "2026-09-18T19:12:29.649Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-10-08T17:35:43.653Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Mistral", "repo": "https://opendev.org/openstack/mistral", "vendor": "OpenStack", "versions": [{"lessThan": "20.1.1", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "21.0.1", "status": "affected", "version": "21.0.0", "versionType": "semver"}, {"lessThan": "22.0.1", "status": "affected", "version": "22.0.0", "versionType": "semver"}, {"status": "affected", "version": "23.0.0", "versionType": "semver"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any policy enforcement. Any holder of a valid Mistral token, regardless of assigned role, can read and change the service's cluster-wide maintenance state. Setting the state to PAUSED stops processing of new workflow and execution objects across all tenant projects until an operator restores it."}], "id": "CVE-2026-93860", "lastModified": "2026-10-09T12:17:13.113", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cve@mitre.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-93860", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-09T11:42:27.603968Z", "version": "2.0.3"}}]}, "published": "2026-10-08T18:18:30.993", "references": [{"source": "cve@mitre.org", "url": "https://launchpad.net/bugs/2162789"}, {"source": "cve@mitre.org", "url": "https://security.openstack.org/ossa/OSSA-2026-044.html"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://bugs.launchpad.net/ossa/+bug/2162789"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "cve@mitre.org", "type": "Secondary"}]}

{"acknowledgement": "Upstream acknowledges Chen YuXiang (Institute of Computing Technology, Chinese Academy of Sciences) as the original reporter.", "bugzilla": {"description": "openstack-mistral: mistral: Unauthenticated-project user can trigger global maintenance mode causing cross-tenant denial of service", "id": "2544712", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544712"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-862", "details": ["A flaw was found in OpenStack Mistral. The maintenance API endpoint is missing an authorization check, allowing any authenticated user to activate global maintenance mode on the Mistral service. When an attacker triggers maintenance mode, all write operations (workflow execution creation, environment creation, and similar API calls) are blocked across all tenant projects on the affected Mistral deployment. This results in a denial of service for all tenants until an administrator or the attacker restores normal operation."], "mitigation": {"lang": "en:us", "value": "No mitigation is currently available that meets Red Hat Product Security's standards for usability, deployment, applicability, or stability."}, "name": "CVE-2026-93860", "package_state": [{"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Out of support scope", "package_name": "openstack-mistral", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Under investigation", "package_name": "openstack-mistral", "product_name": "Red Hat OpenStack Platform 16.2"}], "public_date": "2026-10-08T19:15:40Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-93860\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-93860\nhttps://launchpad.net/bugs/2162789"], "statement": "Red Hat product impact analysis pending. Component mapping is required to determine which Red Hat OpenStack Platform (RHOSP) releases ship an affected version of OpenStack Mistral (versions older than 20.1.1 and exactly 21.0.0, 22.0.0, or 23.0.0). The vulnerability requires the Mistral API to be network-accessible and Keystone authentication to be enabled; deployments where the Mistral API is not exposed or where Mistral is not included are not affected.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,20.1.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[21.0.0,21.0.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[22.0.0,22.0.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "23.0.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Mistral", "source": "cna", "vendor": "OpenStack"}, "product": "mistral", "vendor": "openstack"}], "created": "2026-10-08T18:30:07.596116+00:00", "updated": "2026-10-08T19:15:20.090435+00:00", "vendors": ["openstack", "openstack$PRODUCT$mistral"]}