Zero Day MonitorZDM
DashboardVulnerabilitiesTrendingZero-DaysNewsAbout
Login
ImpressumPrivacy Policy
Zero Day Monitor © 2026
6006 articles · 245881 vulns · 36/41 feeds (7d)
← Back to list
—
CVE-2026-93860PATCHED
openstack · mistral

CVE-2026-93860: In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the mainten

Description

In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any policy enforcement. Any holder of a valid Mistral token, regardless of assigned role, can read and change the service's cluster-wide maintenance state. Setting the state to PAUSED stops processing of new workflow and execution objects across all tenant projects until an operator restores it.

Affected Products

VendorProductVersions
openstackmistral0, 21.0.0, 22.0.0, 23.0.0

References

  • https://launchpad.net/bugs/2162789(issue-tracking)
  • https://security.openstack.org/ossa/OSSA-2026-044.html

Related News (2 articles)

Tier C
oss-security13d ago
[OSSA-2026-044] OpenStack Mistral: Four authorization and privilege vulnerabilities in Mistral (CVE-2026-93858, CVE-2026-93860, CVE-2026-93861, CVE-2026-97147))
→ No new info (linked only)
Tier C
VulDB14d ago
CVE-2026-93860 | OpenStack Mistral up to 20.1.0/21.0.0/22.0.0/23.0.0 Maintenance Service /v2/maintenance privileges management
→ No new info (linked only)

Discussion (0)

Loading…

CISA KEV❌ No
Actively exploited❌ No
Patch available
20.1.121.0.122.0.1
CWECWE-862
PublishedOct 8, 2026
Last enriched14d ago
Trending Score8
Source articles2
Independent2
Info Completeness4/14
Missing: vendor, product, versions, cvss, epss, kev, exploit, patch, iocs, mitre_attack

Community Vote

0
Login to vote
0 upvotes0 downvotes
No votes yet

Related CVEs (5)

HIGHPRE-CVE
oslo.utils LUKS Inspector Logs Cryptographic Key Material
Trending: 27
MEDIUMCVE-2026-93856
CVE-2026-93856: In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API. A non-admin user
Trending: 27
CRITICALCVE-2026-71195
CVE-2026-71195: In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns th
Trending: 26
NONECVE-2026-97147
CVE-2026-97147: In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target object with a query that can r
Trending: 12
NONECVE-2026-93858
CVE-2026-93858: In OpenStack Mistral through 23.0.0, the std.ssh_proxied action passes a caller-supplied proxy_command value directly to
Trending: 9

Pin to Dashboard

Verification

State: verified
Confidence: 100%

Vulnerability Timeline

CVE Published
Oct 8, 2026
Discovered by ZDM
Oct 8, 2026
Patch Available
Oct 9, 2026