Is CVE-2026-115642 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-115642 being exploited in the wild.

How severe is CVE-2026-115642?

High severity, with a CVSS score of 8.3, published 30 October 2026.

Which products and versions are affected?

OpenStack Keystonemiddleware before 13.0.2.

Is there a fix for CVE-2026-115642?

Yes: fixed in keystonemiddleware 13.0.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-115642 attacked?

It is attacked over the network.

Am I affected by CVE-2026-115642?

Check whether you run OpenStack Keystonemiddleware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115642: OpenStack keystonemiddleware access rules bypass via X-Service-Token

CVE-2026-115642 · Severity: high · CVSS 8.3 · Published 2026-10-30

OpenStack keystonemiddleware is a middleware component that authenticates requests to OpenStack services and enforces access control rules on application credentials. An attacker with a low-privilege application credential can bypass these access restrictions by adding a custom X-Service-Token header to requests, allowing them to perform actions normally forbidden by the credential's access rules and assume the full permissions of the credential owner.

Vendors: OpenStack.

Quick answers

Is CVE-2026-115642 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-115642 being exploited in the wild.
How severe is CVE-2026-115642?: High severity, with a CVSS score of 8.3, published 30 October 2026.
Which products and versions are affected?: OpenStack Keystonemiddleware before 13.0.2.
Is there a fix for CVE-2026-115642?: Yes: fixed in keystonemiddleware 13.0.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-115642 attacked?: It is attacked over the network.
Am I affected by CVE-2026-115642?: Check whether you run OpenStack Keystonemiddleware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: keystonemiddleware 13.0.2

Technical details

The vulnerability is an incorrect authorization flaw (CWE-863) in the BaseAuthProtocol.validate_allowed_request() method in keystonemiddleware/auth_token/__init__.py. The code tests only for the presence of the X-Service-Token header to skip access rules validation, rather than properly validating the token's authenticity; an attacker possessing any valid application credential can add an arbitrary X-Service-Token header to bypass access control entirely. The attack requires network access and a low-privilege application credential, with no user interaction needed.

Affected products

OpenStack keystonemiddleware before 13.0.2

Timeline

2026-08-03: disclosed
2026-10-30: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.