High severity · published Oct 8, 2026
CVE-2026-93860
In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any policy enforcement
7.1
CVSS
0.4%
EPSS
No
On KEV
Description
In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any policy enforcement. Any holder of a valid Mistral token, regardless of assigned role, can read and change the service's cluster-wide maintenance state. Setting the state to PAUSED stops processing of new workflow and execution objects across all tenant projects until an operator restores it.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MI
Mistral · OpenStack
before 20.1.1; 21.0.0 before 21.0.1; 22.0.0 before 22.0.1; 23.0.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-93860
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-93860
issue-tracking
https://launchpad.net/bugs/2162789
security.openstack.org
https://security.openstack.org/ossa/OSSA-2026-044.html
More from Mistral
9.9
CVE-2026-41283
OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed
8.7
CVE-2026-93858
In OpenStack Mistral through 23.0.0, the std.ssh_proxied action passes a caller-supplied proxy_command value directly to paramiko.ProxyCommand() before any SSH connection to a…
7.2
CVE-2026-97147
In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target object with a query that can return another project's resource, then write to it
6.0
CVE-2026-93861
In OpenStack Mistral through 23.0.0, the workflow membership API lets a project that has accepted a share of another project's private workflow create a further membership naming…