CVE-2026-93860 Missing authorization in Mistral
Attackers with valid tokens can bypass policy checks to modify cluster-wide maintenance state, potentially halting workflow processing across all tenants.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-93860?
CVE-2026-93860 is a high-severity missing authorization vulnerability in OpenStack Mistral, published on 8 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any policy enforcement. Any holder of a valid Mistral token, regardless of assigned role, can read and change the service's cluster-wide maintenance state. Setting the state to PAUSED stops processing of new workflow and execution objects across all tenant projects until an operator restores it.
Weakness: CWE-862
Which versions are affected by CVE-2026-93860?
How do I fix CVE-2026-93860?
Apply the vendor's patch.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-93860 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-93860 exists.
Sources
Also known as DEBIAN-CVE-2026-93860, GHSA-858j-2m97-g3qm, UBUNTU-CVE-2026-93860.