OpenStack keystonemiddleware access_rules bypass via X-Service-Token
Original title: [OSSA-2026-050] OpenStack keystonemiddleware: access_rules bypass via X-Service-Token (CVE-2026-115642)
OSSA-2026-050 names CVE-2026-115642 and lists several Keystonemiddleware releases, but the posted description is cut off.
Jeremy Stanley posted OpenStack advisory OSSA-2026-050 on October 29, 2026. It assigns CVE-2026-115642 to a keystonemiddleware access_rules bypass involving the X-Service-Token header. The visible affect list is =10.10.0, =11.0.0, =13.0.0 and <13.0.2. The description begins with Nassim Abbaoui of OVHcloud and then ends in the feed snippet.
Unconfirmed: The feed snippet ends before the full description, impact details and any stated fixes.
- The advisory date is October 29, 2026.
- CVE-2026-115642 is the only identifier given.
- Affected lines are written as =10.10.0, =11.0.0, =13.0.0 and <13.0.2.
- No exploitation status appears in the snippet.
Impact: Bypass of keystonemiddleware access_rules via X-Service-Token
| Product | Affected |
|---|---|
| OpenStack Keystonemiddleware | =10.10.0 =11.0.0 =13.0.0 <13.0.2 |
- CVEs
- CVE-2026-115642
- Vendors
- OpenStack
- Products
- Keystonemiddleware
- Organizations
- OVHcloud
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-115642 | Access-rules bypass in OpenStack keystonemiddleware before 13.0.2 | 8.3 | — |
From the original article
Posted by Jeremy Stanley on Oct 29 ========================================================================= OSSA-2026-050: keystonemiddleware access_rules bypass via X-Service-Token ========================================================================= :Date: October 29, 2026 :CVE: CVE-2026-115642 Affects ~~~~~~~ - Keystonemiddleware: =10. 10. 0 =11.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.