CVE-2026-93860
Fixed in a distro release EPSS <1%CVSS 7.1
In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any policy enforcement. Any holder of a valid Mistral token, regardless of assigned role, can read and change the service's cluster-wide maintenance state. Setting the state to PAUSED stops processing of new workflow and execution objects across all tenant projects until an operator restores it.
Products: OpenStack Mistral
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | mistral | no fix |
| Debian 13 | mistral | no fix |
| Debian 14 | mistral | 23.0.0-2 |
| Ubuntu 20.04 LTS | mistral | no fix |
| Ubuntu 22.04 LTS | mistral | no fix |
| Ubuntu 24.04 LTS | mistral | no fix |
| Ubuntu 26.04 LTS | mistral | no fix |
| Ubuntu 26.10 | mistral | no fix |
| Ubuntu Pro 16.04 LTS | mistral | no fix |
| Ubuntu Pro 18.04 LTS | mistral | no fix |