CVE-2026-93860

Severity: high (CVSS 7.1 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-08 · updated 2026-10-09
Weakness: CWE-862

Description

In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any policy enforcement. Any holder of a valid Mistral token, regardless of assigned role, can read and change the service's cluster-wide maintenance state. Setting the state to PAUSED stops processing of new workflow and execution objects across all tenant projects until an operator restores it.

Affected products

OpenStack Mistral: before 20.1.1; from 21.0.0 before 21.0.1; from 22.0.0 before 22.0.1; 23.0.0 — fixed in 20.1.1, 21.0.1, 22.0.1

How to fix

Upgrade to a fixed version: OpenStack Mistral 20.1.1, 21.0.1, 22.0.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-93860 or the next vulnerability affects your stack