CVE-2026-93860
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Oct 08, 2026
Vendor
unknown
Description
In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any policy enforcement. Any holder of a valid Mistral token, regardless of assigned role, can read and change the service's cluster-wide maintenance state. Setting the state to PAUSED stops processing of new workflow and execution objects across all tenant projects until an operator restores it.