CVE-2026-80183 — Type Confusion in Openstack Keystone

Vendor	Product	Version range	Fixed in
openstack	keystone	>= 16.0.0 < 27.0.3	27.0.3
openstack	keystone	>= 28.0.0 < 28.0.3	28.0.3
openstack	keystone	>= 29.0.0 < 29.0.3	29.0.3
rhosp-rhel8	openstack-keystone	—	—
rhosp-rhel9	openstack-keystone	—	—
rhosp13	openstack-keystone	—	—
ubuntu	keystone	—	—

GHSA

In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignment under any domain by passing a domain ID as scope.project.id

ghsa_unreviewed·2026-08-27

CVE-2026-80183 [HIGH] CWE-843 In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignment under any domain by passing a domain ID as scope.project.id In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignment under any domain by passing a domain ID as scope.project.id with include_subtree to the GET /v3/role_assignments endpoint. The domain's project record has domain_id=null, causing the policy domain_id check to pass for any caller. With include_names, the response discloses the names and home-domain IDs of every user, group, project, and role involved. The literal "default" domain ID works against any deployment created with keystone-manage bootstrap. An attacker can harvest domain IDs from the response and repeat the query to map role assignments across the entire cloud. This is caused by misuse of "None" in list_role_assignments_for_tree.

VulDB

OpenStack Keystone up to 27.0.2/28.0.2/29.0.2 Role Assignment list_role_assignments_for_tree scope.project.id information disclosure

vuldb·2026-08-27·CVSS 7.1

CVE-2026-80183 [HIGH] OpenStack Keystone up to 27.0.2/28.0.2/29.0.2 Role Assignment list_role_assignments_for_tree scope.project.id information disclosure A vulnerability labeled as problematic has been found in OpenStack Keystone up to 27.0.2/28.0.2/29.0.2. This impacts the function list_role_assignments_for_tree of the component Role Assignment. The manipulation of the argument scope.project.id results in information disclosure. This vulnerability is reported as CVE-2026-80183. The attack can be launched remotely. No exploit exists. The affected component should be upgraded.

Ubuntu

OpenStack Keystone vulnerabilities

vendor_ubuntu·2026-09-30·CVSS 7.6

CVE-2026-80182 [HIGH] OpenStack Keystone vulnerabilities Title: OpenStack Keystone vulnerabilities Summary: Several security issues were fixed in OpenStack Keystone. Grzegorz Grasza discovered that OpenStack Keystone did not consistently enforce restrictions for delegated authentication tokens. An authenticated attacker could possibly use this issue to create credentials or delegations that outlasted the delegated token. (CVE-2026-80182) It was discovered that OpenStack Keystone incorrectly handled role assignment queries under certain circumstances. An authenticated attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-80183) Tim Shephard discovered that OpenStack Keystone did not properly restrict reauthenticatio

Red Hat

keystone: OpenStack Keystone: Information disclosure via improper handling of domain IDs in role assignment listings

vendor_redhat·2026-08-26·CVSS 7.1

CVE-2026-80183 [HIGH] CWE-639 keystone: OpenStack Keystone: Information disclosure via improper handling of domain IDs in role assignment listings keystone: OpenStack Keystone: Information disclosure via improper handling of domain IDs in role assignment listings In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignment under any domain by passing a domain ID as scope.project.id with include_subtree to the GET /v3/role_assignments endpoint. The domain's project record has domain_id=null, causing the policy domain_id check to pass for any caller. With include_names, the response discloses the names and home-domain IDs of every user, group, project, and role involved. The literal "default" domain ID works against any deployment created with keystone-manage bootstrap. An attacker can harvest domain IDs from the response and repeat the query to map role a

CVE-2026-80183: In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignment under any domain…

Affected

CVSS provenance