high7.1
CVE-2026-93860
In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any polic…
Impact
In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any policy enforcement. Any holder of a valid Mistral token, regardless of assigned role, can read and change the service's cluster-wide maintenance state. Setting the state to PAUSED stops processing of new workflow and execution objects across all tenant projects until an operator restores it.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| OpenStack | OpenStack Mistral | through 23.0.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.