Bug 2544710 (CVE-2026-93861)
| Summary: | CVE-2026-93861 openstack-mistral: mistral: workflow membership sub-delegation allows unauthorized access grant to private workflows | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Robb Gatica <rgatica> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | eglynn, jjoyce, jpretori, jschluet, jslagle, lhh, mburns, mgarciac, security-response-team |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in OpenStack Mistral. An authenticated project that has been granted and accepted access to another project's private workflow can further delegate that access to a third, arbitrary project without the workflow owner's knowledge or consent. The unauthorized delegation succeeds because the membership creation endpoint does not verify that the requesting project is the actual owner of the workflow. This allows an attacker to grant read and execution access to private workflows to projects the owner never authorized, and because the spurious membership record is stored under the delegating project's identity rather than the owner's, the owner cannot see or revoke it.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Deadline: | 2026-10-08 | ||
|
Description
Robb Gatica
2026-10-01 18:56:14 UTC
|