CVE-2026-93860: [OSSA-2026-044] OpenStack Mistral: Four authorization and privilege vulnerabilities in Mistral (CVE-2026-93858, CVE-2026-93860, CVE-2026-93861, CVE-2026-97147))
In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any policy enforcement. Any holder of a valid Mistral token, regardless of assigned role, can read and change the service's cluster-wide maintenance state. Setting the state to PAUSED stops processing of new workflow and execution objects across all tenant projects until an operator restores it.
Affected Software
Event History
Frequently Asked Questions
Are non-administrative Mistral users able to invoke the affected maintenance functions?
Yes. Any holder of a valid Mistral token can access the maintenance controller regardless of their assigned role, because the controller does not enforce policy before calling the maintenance service.
What is the operational impact if an attacker changes the maintenance state?
An attacker can read or change the cluster-wide maintenance state. Setting it to PAUSED stops processing of new workflow and execution objects for all tenant projects until an operator restores the state.
Which Mistral versions are identified as affected?
OpenStack Mistral through version 23.0.0 is identified as affected.