https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-09T05:25:48.913624+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-93860 fkie_cve-2026-93860 2026-10-09T05:25:49.134535+00:00

In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any policy enforcement. Any holder of a valid Mistral token, regardless of assigned role, can read and change the service's cluster-wide maintenance state. Setting the state to PAUSED stops processing of new workflow and execution objects across all tenant projects until an operator restores it.

 https://vulnerability.circl.lu/vuln/ghsa-858j-2m97-g3qm GHSA-858j-2m97-g3qm 2026-10-09T05:25:49.134782+00:00

In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any policy enforcement. Any holder of a valid Mistral token, regardless of assigned role, can read and change the service's cluster-wide maintenance state. Setting the state to PAUSED stops processing of new workflow and execution objects across all tenant projects until an operator restores it.