CVE-2026-93860: CWE-862 Missing Authorization in OpenStack Mistral
Description
In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any policy enforcement. Any holder of a valid Mistral token, regardless of assigned role, can read and change the service's cluster-wide maintenance state. Setting the state to PAUSED stops processing of new workflow and execution objects across all tenant projects until an operator restores it.
CVSS v4.0
Score 7.1high
Affected software
OpenStack
Mistral
pkg:github/openstack/mistralRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
OpenStack Mistral versions up to 23.0.0 contain a missing authorization vulnerability (CWE-862) in the /v2/maintenance API controller. This endpoint clears the request context and directly calls the maintenance service without enforcing any policy, allowing any user with a valid Mistral token, regardless of role, to read and change the cluster-wide maintenance state. Setting the maintenance state to PAUSED halts processing of new workflow and execution objects across all tenant projects until restored by an operator. This can disrupt service availability across multiple tenants.
Potential Impact
An attacker with any valid Mistral token can pause the entire cluster's workflow processing, causing denial of service for all tenant projects. This impacts availability by stopping new workflows and executions until an operator restores the maintenance state. There is no requirement for elevated privileges beyond possessing a valid token.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to valid Mistral tokens and monitor for unauthorized use. Operators should be prepared to restore the maintenance state if it is maliciously set to PAUSED.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mitre
- Date Reserved
- 2026-09-18T19:12:29.649Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ac7d8742cdf04f6562d26c1
Added to database: 10/08/2026, 17:52:52 UTC
Last enriched: 10/08/2026, 18:03:19 UTC
Last updated: 10/08/2026, 21:45:56 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.