65 matches found
SUSE CVE-2026-115642
In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-restricted application credential may bypass those restrictions resulting in elevation of privileges...
DEBIAN-CVE-2026-115642
In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-restricted application credential may bypass those restrictions resulting in elevation of privileges...
CVE-2026-115642
In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-restricted application credential may bypass those restrictions resulting in elevation of privileges...
UBUNTU-CVE-2026-115642
In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-restricted application credential may bypass those restrictions resulting in elevation of privileges...
CVE-2026-115642
In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-restricted application credential may bypass those restrictions resulting in elevation of privileges...
EUVD-2026-114191
In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-restricted application credential may bypass those restrictions resulting in elevation of privileges...
CVE-2026-115642
In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-restricted application credential may bypass those restrictions resulting in elevation of privileges...
CVE-2026-115642
A vulnerability exists in OpenStack keystonemiddleware and Keystone prior to version 13.0.2 . The software incorrectly treats the presence of the X-Service-Token HTTP header as sufficient to bypass access_rules enforcement and related token-binding checks. An attacker possessing an application cr...
CVE-2026-115642
In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-restricted application credential may bypass those restrictions resulting in elevation of privileges...
CVE-2026-115642
In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-restricted application credential may bypass those restrictions resulting in elevation of privileges...
CVE-2026-115642
A flaw was found in OpenStack keystonemiddleware and Keystone. The code incorrectly treats the presence of the X-Service-Token HTTP header as sufficient to skip enforcement of application credential access rules and can skip related token-binding checks. An attacker who holds an application...
PT-2026-133671
In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-restricted application credential may bypass those restrictions resulting in elevation of privileges...
OpenStack Keystone authorization issue vulnerability
Versions of OpenStack Keystone prior to 10.12.2, between 11.0.0 and 12.0.1, as well as between 13.0.0 and 13.0.2 contain an authorization issue vulnerability. This vulnerability stems from improper handling of the custom X-Service-Token header in requests. Attackers possessing access to restricte...
CVE-2026-115642: OpenStack keystonemiddleware: In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in…
In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-restricted application credential may bypass those restrictions resulting in elevation of privileges...
CVE-2026-115642
In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-restricted application credential may bypass those restrictions resulting in elevation of privileges...
CVE-2026-103511
Perforce P4 Search prior to 2026.4.2 does not validate file names supplied to its extension installation feature. An attacker with super-user or service-token privileges can write files with arbitrary content to the P4 Search installation directory...
CVE-2026-103511 Arbitrary file-write via extension installation in P4Search
Perforce P4 Search prior to 2026.4.2 does not validate file names supplied to its extension installation feature. An attacker with super-user or service-token privileges can write files with arbitrary content to the P4 Search installation directory...
CVE-2026-103511 Arbitrary file-write via extension installation in P4Search
Perforce P4 Search prior to 2026.4.2 does not validate file names supplied to its extension installation feature. An attacker with super-user or service-token privileges can write files with arbitrary content to the P4 Search installation directory...
CVE-2026-103511
Prior to version 2026.4.2 , Perforce P4 Search is vulnerable to an arbitrary file-write flaw. The software fails to validate file names provided to its extension installation feature . An attacker possessing super-user or service-token privileges can exploit this to write files containing arbitra...
PT-2026-104759
Perforce P4 Search prior to 2026.4.2 does not validate file names supplied to its extension installation feature. An attacker with super-user or service-token privileges can write files with arbitrary content to the P4 Search installation directory...