# CVE-2026-115642: OpenStack keystonemiddleware access rules bypass via X-Service-Token

Source: https://junglewise.ai/threats/cve-2026-115642-in-openstack-keystonemiddleware-before-13-0-2-by-supplying-a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-115642 · Severity: high · CVSS 8.3 · Published 2026-10-30

OpenStack keystonemiddleware is a middleware component that authenticates requests to OpenStack services and enforces access control rules on application credentials. An attacker with a low-privilege application credential can bypass these access restrictions by adding a custom X-Service-Token header to requests, allowing them to perform actions normally forbidden by the credential's access rules and assume the full permissions of the credential owner.

Vendors: [OpenStack](https://junglewise.ai/threats/vendors/openstack).

## Quick answers

**Is CVE-2026-115642 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115642 being exploited in the wild.

**How severe is CVE-2026-115642?** High severity, with a CVSS score of 8.3, published 30 October 2026.

**Which products and versions are affected?** OpenStack Keystonemiddleware before 13.0.2.

**Is there a fix for CVE-2026-115642?** Yes: fixed in keystonemiddleware 13.0.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-115642 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-115642?** Check whether you run OpenStack Keystonemiddleware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in keystonemiddleware 13.0.2

## Technical details

The vulnerability is an incorrect authorization flaw (CWE-863) in the BaseAuthProtocol.validate_allowed_request() method in keystonemiddleware/auth_token/__init__.py. The code tests only for the presence of the X-Service-Token header to skip access rules validation, rather than properly validating the token's authenticity; an attacker possessing any valid application credential can add an arbitrary X-Service-Token header to bypass access control entirely. The attack requires network access and a low-privilege application credential, with no user interaction needed.

## Affected products

- OpenStack keystonemiddleware before 13.0.2

## Timeline

- 2026-08-03: disclosed
- 2026-10-30: patched

## References

- [https://bugs.launchpad.net/keystonemiddleware/+bug/2162748](https://bugs.launchpad.net/keystonemiddleware/+bug/2162748)
- [https://github.com/openstack/keystonemiddleware/tags](https://github.com/openstack/keystonemiddleware/tags)

## Related threats

- [OpenStack keystonemiddleware privilege escalation via identity header spoofing](https://junglewise.ai/threats/cve-2026-22797-openstack-keystonemiddleware-privilege-escalation-via-identity)