CVE-2026-80183: High severity Openstack Keystone vulnerability
In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignment under any domain by passing a domain ID as scope.project.id with includesubtree to the GET /v3/roleassignments endpoint. The domain's project record has domainid=null, causing the policy domainid check to pass for any caller. With includenames, the response discloses the names and home-domain IDs of every user, group, project, and role involved. The literal "default" domain ID works against any deployment created with keystone-manage bootstrap. An attacker can harvest domain IDs from the response and repeat the query to map role assignments across the entire cloud. This is caused by misuse of "None" in
listroleassignmentsfortree.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated user with the reader role on any project can exploit it. The role does not need to be associated with the domain whose role assignments are queried.
Are standard Keystone deployments affected without knowing a target domain ID?
Deployments created with keystone-manage bootstrap can be queried using the literal domain ID "default." The response can then reveal additional domain IDs that can be used to enumerate role assignments across the cloud.
What information can be exposed?
Using include_names exposes the names and home-domain IDs of users, groups, projects, and roles in the returned project-scoped role assignments. This can allow an attacker to map role relationships across domains.
What request pattern indicates attempted exploitation?
The affected API is GET /v3/role_assignments with a domain ID supplied through scope.project.id and include_subtree enabled. Requests that also include include_names are intended to retrieve identifying details for the returned assignments.