{"id":"CVE-2026-93860","published":"2026-10-08T18:18:30.993","lastModified":"2026-10-09T12:17:13.113","description":"In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any policy enforcement. Any holder of a valid Mistral token, regardless of assigned role, can read and change the service's cluster-wide maintenance state. Setting the state to PAUSED stops processing of new workflow and execution objects across all tenant projects until an operator restores it.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://launchpad.net/bugs/2162789","tags":[]},{"url":"https://security.openstack.org/ossa/OSSA-2026-044.html","tags":[]},{"url":"https://bugs.launchpad.net/ossa/+bug/2162789","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}