OpenStack Keystone Inconsistent Delegated Token Scope Execution Vulnerability (CVE-2026-pending)

Vulnerability Overview Vulnerability Name: OpenStack Keystone Inconsistent Delegation Token Scope Enforcement (CVE-2026-pending) Vulnerability Description: OpenStack Keystone failed to consistently prevent delegation tokens from creating new long-term credentials or authorizing new delegations. Tze Shephard (roial.ca) separately reported that delegation tokens could be submitted via the token-method authentication path to evade their project scope. Impact: All Keystone deployments that allow delegation authentication via OAuth access tokens, application credentials, or trust are affected. Affected Versions Affected Versions: - Keystone: >=13.0.0 =28.0.0 =29.0.0 <29.0.3 Remediation Patch Links: - https://review.opendev.org/1002307 (2025.1/epoxy) - https://review.opendev.org/1002308 (2025.1/epoxy) - https://review.opendev.org/1002305 (2025.2/flamingo) - https://review.opendev.org/1002306 (2025.2/flamingo) - https://review.opendev.org/1002303 (2026.1/keppach) - https://review.opendev.org/1002304 (2026.1/keppach) - https://review.opendev.org/1002301 (2026.2/hibiscus (development)) - https://review.opendev.org/1002302 (2026.2/hibiscus (development)) Additional Information Reporters: Grzegorz Grzasa (Red Hat), Tze Shephard (roial.ca) References: - https://launchpad.net/bugs/2153453 - https://launchpad.net/bugs/2150538 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-pending - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-pending Notes Two CVEs have been requested from MITRE and are pending allocation. The two patchsets are interdependent and must be applied together. After upgrading, Keystone will no longer support delegation authentication via OAuth access tokens, application credentials, or trust. Deployments running custom or third-party authentication plugins must add or these authentication methods will become invalid. This advisory does not cover a related weakness in the handling of EC2 credential , which is being tracked and covered in a public and private OpenStack Security Note (OSSN). It is recommended that the relevant fix be proposed in the Keystone Tempest plugin test suite. Attachments Download attachment "OpenPGP_0x063BDAD3B2C3008.asc" type "application/pgp-keys" (3241 bytes) Download attachment "OpenPGP_signature.asc" type "application/pgp-signature" (841 bytes) Other Provided by bliss - more mailing lists Please check the Open Source Software Security Wiki, which is the counterpart to this mailing list. Confused about the mailing list and its usage? Read the mailing list article on Wikipedia, and view these guidelines on how to properly format your messages.

Goal Reached Thanks to every supporter — we hit 100%!

OpenStack Keystone Inconsistent Delegated Token Scope Execution Vulnerability (CVE-2026-pending)

More from this source