CVE-2026-115642

In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-restricted application credential may bypass those restrictions resulting in elevation of privileges...

CVE-2026-115642

In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-restricted application credential may bypass those restrictions resulting in elevation of privileges...

UBUNTU-CVE-2026-115642

In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-restricted application credential may bypass those restrictions resulting in elevation of privileges...

EUVD-2026-114191

In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-restricted application credential may bypass those restrictions resulting in elevation of privileges...

CVE-2026-115642

In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-restricted application credential may bypass those restrictions resulting in elevation of privileges...

CVE-2026-115642

A vulnerability exists in OpenStack keystonemiddleware and Keystone prior to version 13.0.2 . The software incorrectly treats the presence of the X-Service-Token HTTP header as sufficient to bypass access_rules enforcement and related token-binding checks. An attacker possessing an application cr...

CVE-2026-115642

In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-restricted application credential may bypass those restrictions resulting in elevation of privileges...

CVE-2026-115642

In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-restricted application credential may bypass those restrictions resulting in elevation of privileges...

Important: Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (python-botocore) security update

An update for python-botocore is now available for Red Hat OpenStack Platform 17.1 Wallaby. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Important: Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 (python-botocore) security update

An update for python-botocore is now available for Red Hat OpenStack Platform 16.2 Train. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Important: Red Hat Security Advisory: Red Hat OpenStack Services on OpenShift 18.0 (python-botocore) security update

An update for python-botocore is now available for Red Hat OpenStack Services on OpenShift 18.0 Antelope. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Important: Red Hat Security Advisory: Red Hat OpenStack Platform 13.0 (python-botocore) security update

An update for python-botocore is now available for Red Hat OpenStack Platform 13 Queens. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CVE-2026-115642

A flaw was found in OpenStack keystonemiddleware and Keystone. The code incorrectly treats the presence of the X-Service-Token HTTP header as sufficient to skip enforcement of application credential access rules and can skip related token-binding checks. An attacker who holds an application...

RHEL 7 : Red Hat OpenStack Platform 13.0 (python-botocore) (RHSA-2026:93043)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:93043 advisory. A low-level interface to a growing number of Amazon Web Services. The botocore package is the foundation for the AWS CLI as well as boto3. Security...

RHEL 8 : Red Hat OpenStack Platform 16.2 (python-botocore) (RHSA-2026:93044)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:93044 advisory. A low-level interface to a growing number of Amazon Web Services. The botocore package is the foundation for the AWS CLI as well as boto3. Security...

OpenStack Keystone authorization issue vulnerability

Versions of OpenStack Keystone prior to 10.12.2, between 11.0.0 and 12.0.1, as well as between 13.0.0 and 13.0.2 contain an authorization issue vulnerability. This vulnerability stems from improper handling of the custom X-Service-Token header in requests. Attackers possessing access to restricte...

CVE-2026-115642: OpenStack keystonemiddleware: In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in…

In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-restricted application credential may bypass those restrictions resulting in elevation of privileges...

PT-2026-133671

In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-restricted application credential may bypass those restrictions resulting in elevation of privileges...

RHEL 9 : Red Hat OpenStack Platform 17.1 (python-botocore) (RHSA-2026:93045)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:93045 advisory. A low-level interface to a growing number of Amazon Web Services. The botocore package is the foundation for the AWS CLI as well as boto3. Security...

RHEL 9 : Red Hat OpenStack Services on OpenShift 18.0 (python-botocore) (RHSA-2026:93046)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:93046 advisory. A low-level interface to a growing number of Amazon Web Services. The botocore package is the foundation for the AWS CLI as well as boto3. Security...