CVE-2026-115642 in keystonemiddleware
Summary
by MITRE • 10/30/2026
In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-restricted application credential may bypass those restrictions resulting in elevation of privileges.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in versions of the keystone middleware prior to release 13.0.2 represents a critical authentication and authorization flaw within the OpenStack identity service architecture. This component serves as the central point for managing user identities, roles, and access policies across various cloud infrastructure services. The core issue stems from an improper validation mechanism when processing HTTP headers during request authentication. Specifically, the middleware fails to adequately distinguish between standard session tokens and application credentials when a custom X-Service-Token header is present in an incoming API request. This oversight allows attackers who possess valid but restricted application credentials to manipulate the token handling logic, effectively tricking the system into treating these limited credentials as if they were unrestricted service tokens or higher-privilege administrative tokens.
From a technical perspective, this flaw constitutes an authorization bypass where the security context of the user is incorrectly elevated based on header manipulation rather than actual permission grants. The X-Service-Token header is typically intended for internal service-to-service communication within OpenStack deployments, carrying specific trust scopes that differ from standard user application credentials. By injecting or modifying this header to include a restricted application credential, an attacker exploits the middleware's failure to verify the token type and its associated scope restrictions properly. This leads to privilege escalation because the downstream services accept the request as if it originated from a more privileged entity than the actual holder of the credential. The vulnerability aligns with CWE-269 Improper Privilege Management and CWE-862 Missing Authorization, highlighting fundamental failures in enforcing least privilege principles during runtime authentication processes.
The operational impact of this vulnerability is severe for any OpenStack deployment relying on keystone middleware versions affected by this flaw. An attacker who has obtained access-restricted application credentials can leverage this weakness to bypass intended security boundaries and gain unauthorized elevated privileges within the cloud environment. This could result in full compromise of tenant resources, including virtual machines, storage volumes, and network configurations that should remain isolated or restricted under normal policy enforcement. Furthermore, since keystone middleware is often used as a gateway for multiple OpenStack services such as Nova, Cinder, and Neutron, successful exploitation can lead to lateral movement across the infrastructure. The attacker may exfiltrate sensitive data, modify critical system states, or establish persistent backdoors that are difficult to detect due to the legitimate appearance of the elevated session tokens.
Mitigation strategies primarily involve upgrading the keystone middleware package to version 13.0.2 or later where this validation logic has been corrected to properly enforce token type distinctions and scope restrictions regardless of header presence. In environments where immediate patching is not feasible, administrators should implement strict network segmentation to limit access to OpenStack API endpoints from untrusted networks. Additionally, deploying Web Application Firewalls with rules that inspect and restrict the X-Service-Token header can provide a temporary layer of defense by blocking requests containing unexpected or malformed service tokens. Continuous monitoring for anomalous authentication patterns and privilege escalation attempts is also recommended to detect potential exploitation activities in real time. This incident underscores the importance of rigorous input validation and strict adherence to security standards like MITRE ATT&CK technique T1078 Valid Accounts, particularly when dealing with internal service communication protocols that are often targeted by advanced persistent threats seeking initial footholds or privilege escalation paths within cloud-native architectures.