CVE-2026-80183
published 2026-08-27CVE-2026-80183: In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignment under any domain…
PriorityP335high7.1CVSS 4.0
AVNACLATNPRLUINVCHVINVANSCLSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.23%
13.2th percentile
In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignment under any domain by passing a domain ID as scope.project.id with include_subtree to the GET /v3/role_assignments endpoint. The domain's project record has domain_id=null, causing the policy domain_id check to pass for any caller. With include_names, the response discloses the names and home-domain IDs of every user, group, project, and role involved. The literal "default" domain ID works against any deployment created with keystone-manage bootstrap. An attacker can harvest domain IDs from the response and repeat the query to map role assignments across the entire cloud. This is caused by misuse of "None" in
list_role_assignments_for_tree.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openstack | keystone | >= 16.0.0 < 27.0.3 | 27.0.3 |
| openstack | keystone | >= 28.0.0 < 28.0.3 | 28.0.3 |
| openstack | keystone | >= 29.0.0 < 29.0.3 | 29.0.3 |
| rhosp-rhel8 | openstack-keystone | — | — |
| rhosp-rhel9 | openstack-keystone | — | — |
| rhosp13 | openstack-keystone | — | — |
CVSS provenance
nvdv4.07.1HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignment under any domain by passing a domain ID as scope.project.id
ghsa_unreviewed·2026-08-27
CVE-2026-80183 [HIGH] CWE-843 In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignment under any domain by passing a domain ID as scope.project.id
In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignment under any domain by passing a domain ID as scope.project.id with include_subtree to the GET /v3/role_assignments endpoint. The domain's project record has domain_id=null, causing the policy domain_id check to pass for any caller. With include_names, the response discloses the names and home-domain IDs of every user, group, project, and role involved. The literal "default" domain ID works against any deployment created with keystone-manage bootstrap. An attacker can harvest domain IDs from the response and repeat the query to map role assignments across the entire cloud. This is caused by misuse of "None" in
list_role_assignments_for_tree.
VulDB
OpenStack Keystone up to 27.0.2/28.0.2/29.0.2 Role Assignment list_role_assignments_for_tree scope.project.id information disclosure
vuldb·2026-08-27·CVSS 7.1
CVE-2026-80183 [HIGH] OpenStack Keystone up to 27.0.2/28.0.2/29.0.2 Role Assignment list_role_assignments_for_tree scope.project.id information disclosure
A vulnerability labeled as problematic has been found in OpenStack Keystone up to 27.0.2/28.0.2/29.0.2. This impacts the function list_role_assignments_for_tree of the component Role Assignment. The manipulation of the argument scope.project.id results in information disclosure.
This vulnerability is reported as CVE-2026-80183. The attack can be launched remotely. No exploit exists.
The affected component should be upgraded.
Red Hat
keystone: OpenStack Keystone: Information disclosure via improper handling of domain IDs in role assignment listings
vendor_redhat·2026-08-26·CVSS 7.1
CVE-2026-80183 [HIGH] CWE-639 keystone: OpenStack Keystone: Information disclosure via improper handling of domain IDs in role assignment listings
keystone: OpenStack Keystone: Information disclosure via improper handling of domain IDs in role assignment listings
In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignment under any domain by passing a domain ID as scope.project.id with include_subtree to the GET /v3/role_assignments endpoint. The domain's project record has domain_id=null, causing the policy domain_id check to pass for any caller. With include_names, the response discloses the names and home-domain IDs of every user, group, project, and role involved. The literal "default" domain ID works against any deployment created with keystone-manage bootstrap. An attacker can harvest domain IDs from the response and repeat the query to map role a
No detection rules found.
No public exploits indexed.
2026-08-27
Published