OpenStack keystonemiddleware bypasses access_rules via service token
CVE-2026-115642 lets holders of restricted application credentials escalate privileges with a crafted X-Service-Token header.
OpenStack has fixed a privilege-escalation flaw in keystonemiddleware that lets anyone with an access-restricted application credential sidestep those limits.
Nassim Abbaoui of OVHcloud reported the issue, now tracked as CVE-2026-115642. Supplying a custom X-Service-Token header on a request bypasses application credential access_rules enforcement, elevating the caller's privileges. Deployments that use access_rules, or that enforce token binding, are affected.
The bug spans several keystonemiddleware lines: releases before 10.9.2, 10.10.x before 10.12.2, 11.x before 12.0.1, and 13.x before 13.0.2. Patches are available for the supported OpenStack series. Jeremy Stanley of the OpenStack Vulnerability Management Team published the advisory as OSSA-2026-050.