As cited
Copy frozen at (site build).
vulnerabilities
[OSSA-2026-050] OpenStack keystonemiddleware: access_rules bypass via X-Service-Token (CVE-2026-115642)
OpenStack keystonemiddleware versions before 10.9.2, 10.10.0 through 10.12.1, 11.0.0 through 12.0.0, and 13.0.0 through 13.0.1 contain an access_rules bypass vulnerability via the X-Service-Token header. The flaw allows attackers to circumvent access controls in keystonemiddleware. Patched versions have been released to address CVE-2026-115642.
Why it matters: OpenStack operators using affected keystonemiddleware versions face unauthorized access risks; immediate patching to 10.9.2, 10.12.2, 12.0.1, or 13.0.2 and later is required to prevent token-based access control bypasses.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
[OSSA-2026-050] OpenStack keystonemiddleware: access_rules bypass via X-Service-Token (CVE-2026-115642)
OpenStack keystonemiddleware versions before 10.9.2, 10.10.0 through 10.12.1, 11.0.0 through 12.0.0, and 13.0.0 through 13.0.1 contain an access rules bypass vulnerability via X-Service-Token. The vulnerability was discovered by Nassim Abbaoui at OVHcloud and assigned CVE-2026-115642 with a CVSS 3.1 score of 8.3.
Why it matters: OpenStack operators running affected keystonemiddleware versions should update immediately to block potential unauthorized access through token validation bypass in their identity and access control layer.
- Source published
- First seen by Cybersecurity Tracker