8.3
High
CVE-2026-115642 In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in…
Description
In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-restricted application credential may bypass those restrictions resulting in elevation of privileges.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| keystonemiddleware 13.0 | 13.0.0 → < 13.0.2 | 13.0.2 |
| keystonemiddleware 11.0 | 11.0.0 → < 12.0.1 | 12.0.1 |
| keystonemiddleware 10.12 | earliest → < 10.12.2 | 10.12.2 |
References
- bugs.launchpad.net bugs.launchpad.net
- github.com github.com
- www.openwall.com www.openwall.com
Timeline
- Published
- Last modified