This issue arises from the /v2/maintenance API controller in OpenStack Mistral, which clears the request context before invoking the maintenance service. The controller lacks policy enforcement, allowing any user holding a valid Mistral token to read and modify the service’s global maintenance state. An attacker who can acquire a token can set the state to PAUSED, halting processing of new workflow and execution objects for every tenant. This results in a service‑wide outage, impacting the confidentiality, integrity, and availability of all tenant applications that rely on Mistral workflows. The weakness is a missing authorization check (CWE‑862).

The vulnerability affects OpenStack Mistral versions up to and including 23.0.0. All deployments using these releases are susceptible unless patched or the affected API is disabled.

The CVSS score of 7.1 indicates a moderate severity. EPSS data is unavailable, and the vulnerability is not yet listed in CISA KEV, so timely exploitation is uncertain but possible. The attack vector likely requires an authenticated Mistral session, which could be obtained via legitimate credentials, social engineering, or token replay. Once authenticated, an attacker can exploit the lack of authorization to pause the service, causing denial of service across all tenants.