OpenStack Keystone Cross-Domain Info Disclosure (CVE-2025-35165)

Vulnerability Key Information Summary Vulnerability Overview Title: CVE Number: CVE-2025-35165 Type: Cross-domain Information Disclosure via Authorization Bypass Severity: Critical Status: In Progress People Affected: 1 person Description: In OpenStack Keystone, the endpoint has a cross-domain bypass issue under default configuration. An attacker (e.g., the demo user) can list role assignment information for other domains (such as the domain) even if the user has no roles in those domains. The root cause is that the endpoint does not correctly validate access permissions for the target domain ( ) when is true. A non-null is incorrectly treated as , allowing the reading of data from other domains. Affected Scope Affected Component: OpenStack Keystone (Identity Service) Affected Versions: - All Keystone instances using the endpoint under default configuration - Specifically, when the parameter is set to true, an attacker can bypass domain isolation and read role assignment data from other domains Impact: - Information Disclosure: An attacker can retrieve role assignment information from other domains (e.g., role assignments in the domain) - Potential Impact: Role assignment data for entities such as users, projects, and groups - Under default configuration, the parameter for the endpoint defaults to true, leading to cross-domain data leakage Fix Solution Fix Status: In Progress Fix Patches: - Patch 1: (0.6 KB, text/plain) - Patch 2: (0.5 KB, text/plain) - Patch 3: (0.5 KB, text/plain) - Patch 4: (0.5 KB, text/plain) - Patch 5: (0.5 KB, text/plain) - Patch 6: (0.5 KB, text/plain) Fix Recommendations: - In the endpoint, when is true, access permissions for should be correctly validated - Ensure that a non-null is not incorrectly treated as - Under default configuration, the use of the parameter should be restricted, or domain isolation checks should be added POC Code Other Key Information Reporter: Graziano Grazia Assigned To: Graziano Grazia Milestone: Not specified Related CVE: CVE-2025-35165 Fix Timeline: - 2026-05-30: Report created - 2026-07-01: Status changed to Incomplete - 2026-07-01: Graziano Grazia confirmed the vulnerability and identified affected Keystone versions - 2026-07-02: Graziano Grazia proposed a fix - 2026-07-04: Boris Bobrov confirmed the vulnerability and recommended making it public - 2026-07-06: Graziano Grazia agreed to add a release note - 2026-07-07: Graziano Grazia confirmed this is the only exploitable manifestation of the vulnerability - 2026-07-07: Graziano Grazia updated the status to In Progress - 2026-07-07: Final patch released - 2026-08-07: Multiple patch versions released - 2026-08-11: Graziano Grazia confirmed that a CVE has been assigned - 2026-08-11: Graziano Grazia confirmed public disclosure of the CVE - 2026-08-18: Graziano Grazia confirmed public disclosure of the CVE - 2026-08-25: Graziano Grazia confirmed public disclosure of the CVE - 2026-08-25: Graziano Grazia confirmed public disclosure of the CVE - 2026-08-25: Graziano Grazia confirmed public disclosure of the CVE - 2026-08-25: Graziano Grazia confirmed public disclosure of the CVE - 2026-08-25: Graziano Grazia confirmed public disclosure of the CVE - 2026-08-25: Graziano Grazia confirmed public disclosure of the CVE - 2026-08-25: Graziano Grazia confirmed public disclosure of the CVE - 2026-08-25: Graziano Grazia confirmed public disclosure of the CVE - 2026-08-25: Graziano Grazia confirmed public disclosure of the CVE - 2026-08-25: Graziano Grazia confirmed public disclosure of the CVE - 2026-08-25: Graziano Grazia confirmed public disclosure of the CVE - 2026-08-25: Graziano Grazia confirmed public disclosure of the CVE - 2026-08-25: Graziano Grazia confirmed public disclosure of the CVE - 2026-08-25: Graziano Grazia confirmed public disclosure of the CVE - 2026-08-25: Graziano Grazia confirmed public disclosure of the CVE - 2026-08-25: Graziano Grazia confirmed public disclosure of the CVE - 2026-08-25: Graziano Grazia confirmed public disclosure of the CVE - 2026-08-25: Graziano Grazia confirmed public disclosure of the CVE - 2026-08-25: Graziano Grazia confirmed public disclosure of the CVE - 2026-08-25: Graziano Grazia confirmed public disclosure of the CVE - 2026-08-25: Graziano Grazia confirmed public disclosure of the CVE - 2026-08-25: Graziano Grazia confirmed public disclosure of the CVE - 2026-08-25: Graziano Grazia confirmed public disclosure of the CVE - 2026-08-25: Graziano Grazia confirmed public disclosure of the CVE - 2026-08-25: Graziano Grazia confirmed public disclosure of the CVE - 2026-08-25: Graziano Grazia confirmed public disclosure of the CVE - 2026-08-25: Graziano Grazia confirmed public disclosure of the CVE - 2026-08-25: Graziano Grazia confirmed public disclosure of the CVE - 2026-08-25: Graziano Grazia confirmed public disclosure of the CVE - 2026-08-25: Graziano Grazia confirmed public disclosure of the CVE - 2026-08-25: Graziano Grazia confirmed public disclosure of the CVE

Goal Reached Thanks to every supporter — we hit 100%!

OpenStack Keystone Cross-Domain Info Disclosure (CVE-2025-35165)