# CVE-2026-115642

Privilege escalation in OpenStack keystonemiddleware via X-Service-Token header

- Page: https://www.vulneraibility.com/cve/CVE-2026-115642
- CVSS: 8.3
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.51% (percentile 43.5)
- CISA SSVC: exploitation none, automatable no, technical impact total (assessed 2026-10-30)
- Weakness: CWE-863
- Published: 2026-10-30

## Affected versions

- OpenStack keystonemiddleware: affected < 10.12.2; >= 11.0.0 and < 12.0.1; >= 13.0.0 and < 13.0.2

A version outside these ranges is not a statement that it is unaffected.

## Impact

Bypass application-credential restrictions using a custom X-Service-Token header, enabling privilege escalation in OpenStack identity middleware.

## Action

Immediate action required

## Recommendation

Upgrade keystonemiddleware to 13.0.2+; or block/strip X-Service-Token and rotate app credentials

## References

- [other] https://bugs.launchpad.net/keystonemiddleware/+bug/2162748
- [other] https://github.com/openstack/keystonemiddleware/tags
- [other] https://www.openwall.com/lists/oss-security/2026/10/29/2
- [other] http://www.openwall.com/lists/oss-security/2026/10/29/2

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.