CVE-2026-93861 Overview
CVE-2026-93861 is an authorization flaw in OpenStack Mistral through version 23.0.0. The workflow membership API allows a project that has accepted a share of another project's private workflow to create additional membership entries naming a third project. The new membership row stores its project_id as the accepting project rather than the original workflow owner. As a result, the owner cannot see or revoke the delegated share. A third project can accept this unauthorized membership and then read and execute the owner's private workflow. The vulnerability is tracked under CWE-863: Incorrect Authorization.
Critical Impact
An authenticated tenant can re-share another tenant's private workflow to arbitrary third-party projects without the owner's visibility or ability to revoke access.
Affected Products
- OpenStack Mistral through 23.0.0
- Deployments exposing the workflow membership API to multi-tenant users
- OpenStack clouds relying on Mistral for cross-project workflow sharing
Discovery Timeline
- 2026-10-08 - CVE-2026-93861 published to NVD
- 2026-10-15 - Last updated in NVD database
Technical Details for CVE-2026-93861
Vulnerability Analysis
Mistral exposes a workflow membership API that governs which projects can view and execute a workflow owned by another project. When Project A shares a private workflow with Project B, Project B accepts the membership and gains access. The flaw occurs when Project B then issues a membership creation request naming Project C as a new member of the same workflow. Mistral records the new membership with project_id set to Project B, not to Project A. The original owner, Project A, never sees this record and cannot delete it. Project C can accept and use the workflow as if it were legitimately shared. Only Project B retains the ability to revoke the delegated share.
Root Cause
The root cause is incorrect authorization logic in the membership creation path. Mistral does not validate that the caller owns the workflow before accepting a new membership row. It also assigns ownership of the membership record to the authenticated caller instead of to the workflow owner. This breaks the authorization model that private workflows should only be shared by their owner.
Attack Vector
An attacker needs valid OpenStack credentials for a project that has already received a legitimate workflow share. Using the Mistral API, the attacker issues a membership creation request targeting a third project. No elevated privileges, user interaction, or local access are required. The exploitation is purely network-based against the Mistral API endpoint. The vulnerability affects confidentiality because unauthorized projects gain read and execute access to private workflows, which may contain sensitive automation logic or credentials referenced through workflow inputs.
No verified proof-of-concept code is publicly available. Refer to the OpenStack Security Advisory OSSA-2026-044 and the Launchpad Bug Report #2161277 for authoritative technical details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-93861
Indicators of Compromise
- Mistral membership rows where project_id does not match the owning project of the referenced workflow.
- API audit logs showing POST /v2/workflows/{id}/members requests originating from projects that are not the workflow owner.
- Workflow executions launched by projects that were never explicitly granted access by the original owner.
Detection Strategies
- Audit the Mistral database to enumerate membership entries and compare project_id of each membership against the project_id of the parent workflow.
- Correlate Keystone authentication events with Mistral membership API calls to identify unexpected cross-tenant sharing activity.
- Review workflow execution history for executions initiated by tenants outside the owner's documented sharing policy.
Monitoring Recommendations
- Enable verbose API logging on the Mistral service and forward logs to a centralized SIEM for continuous review.
- Alert on any membership creation API call issued by a project that is not the workflow owner.
- Periodically reconcile intended workflow sharing policy against the live membership table.
How to Mitigate CVE-2026-93861
Immediate Actions Required
- Review all existing Mistral workflow memberships and remove any entries that were not created by the legitimate workflow owner.
- Restrict access to the Mistral membership API through policy files until a patched release is deployed.
- Rotate any secrets or credentials that may have been exposed through unauthorized workflow execution.
Patch Information
Consult the OpenStack Security Advisory OSSA-2026-044 for the authoritative list of patched versions and backports. Operators running Mistral 23.0.0 or earlier should upgrade to the fixed release identified in the advisory. The Launchpad Bug Report #2161277 tracks the upstream fix and related code review discussion.
Workarounds
- Modify the Mistral policy.yaml to restrict the membership:create action to administrators until the patch is applied.
- Disable cross-project workflow sharing in multi-tenant environments where strict isolation is required.
- Implement database-level constraints or scheduled jobs that remove membership rows whose project_id does not match the workflow owner.
# Example Mistral policy restriction (policy.yaml)
# Limits workflow membership creation to admins only
"membership:create": "role:admin"
"membership:delete": "role:admin or project_id:%(workflow.project_id)s"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
