CVE-2026-80184
published 2026-08-25CVE-2026-80184: In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms (OAuth1 access tokens, application credentials, trusts) could be…
PriorityP353high7.6CVSS 4.0
AVNACLATPPRLUINVCHVIHVANSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.60%
48.1th percentile
In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms (OAuth1 access tokens, application credentials, trusts) could be submitted to the token-method authentication path for reauthentication to escape their intended project scope. When an application credential token was presented with no explicit scope, Keystone would issue a new token scoped to the credential owner's default project rather than the project for which the credential was issued, bypassing the intended project boundary. All Keystone deployments that permit delegated authentication through OAuth1 access tokens, application credentials, or trusts are affected.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openstack | keystone | >= 13.0.0 < 27.0.3 | 27.0.3 |
| openstack | keystone | >= 28.0.0 < 28.0.3 | 28.0.3 |
| openstack | keystone | >= 29.0.0 < 29.0.3 | 29.0.3 |
| ubuntu | keystone | — | — |
CVSS provenance
nvdv4.07.6HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat7.6HIGH
vendor_ubuntu7.6HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
OpenStack Keystone vulnerabilities
vendor_ubuntu·2026-09-30·CVSS 7.6
CVE-2026-80182 [HIGH] OpenStack Keystone vulnerabilities
Title: OpenStack Keystone vulnerabilities
Summary: Several security issues were fixed in OpenStack Keystone.
Grzegorz Grasza discovered that OpenStack Keystone did not consistently
enforce restrictions for delegated authentication tokens. An authenticated
attacker could possibly use this issue to create credentials or delegations
that outlasted the delegated token. (CVE-2026-80182)
It was discovered that OpenStack Keystone incorrectly handled role
assignment queries under certain circumstances. An authenticated attacker
could possibly use this issue to obtain sensitive information. This
issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04
LTS, and Ubuntu 26.04 LTS. (CVE-2026-80183)
Tim Shephard discovered that OpenStack Keystone did not properly
restrict reauthenticatio
Red Hat
keystone: keystone: Application credential tokens can escape project scope via token-method reauthentication
vendor_redhat·2026-08-25·CVSS 7.6
CVE-2026-80184 [HIGH] CWE-863 keystone: keystone: Application credential tokens can escape project scope via token-method reauthentication
keystone: keystone: Application credential tokens can escape project scope via token-method reauthentication
In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms (OAuth1 access tokens, application credentials, trusts) could be submitted to the token-method authentication path for reauthentication to escape their intended project scope. When an application credential token was presented with no explicit scope, Keystone would issue a new token scoped to the credential owner's default project rather than the project for which the credential was issued, bypassing the intended project boundary. All Keystone deployments that permit delegated authentication through OAuth1 access tokens, application credentials, or trusts are affected.
A flaw was found in
GHSA
In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms (OAuth1 access tokens, application credentials, trusts) could be submitted to the token-method authenticati
ghsa_unreviewed·2026-08-26
CVE-2026-80184 [HIGH] CWE-863 In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms (OAuth1 access tokens, application credentials, trusts) could be submitted to the token-method authenticati
In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms (OAuth1 access tokens, application credentials, trusts) could be submitted to the token-method authentication path for reauthentication to escape their intended project scope. When an application credential token was presented with no explicit scope, Keystone would issue a new token scoped to the credential owner's default project rather than the project for which the credential was issued, bypassing the intended project boundary. All Keystone deployments that permit delegated authentication through OAuth1 access tokens, application credentials, or trusts are affected.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-08-25
Published