UBUNTU-CVE-2026-115642: High severity ubuntu/python-keystonemiddleware vulnerability
In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-restricted application credential may bypass those restrictions resulting in elevation of privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenStack keystonemiddlewareto a version that resolves this vulnerability.Fixed in 13.0.2
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker must possess an application credential that is access-restricted and be able to send requests to the affected application. Exploitation involves supplying a custom X-Service-Token header.
Who is exposed to this vulnerability?
Deployments using OpenStack keystonemiddleware before 13.0.2 are affected where access-restricted application credentials are accepted. An attacker with such a credential may elevate privileges beyond its intended restrictions.
What is the remediation?
Update OpenStack keystonemiddleware to version 13.0.2 or later. The provided information does not identify a mitigation for systems that cannot be updated immediately.