CVE-2026-90460: Openstack Keystone vulnerability
An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods (EC2 credentials, application credentials, OAuth1 access tokens, and trusts) are not blocked from creating, modifying, or deleting credentials via the /v3/credentials API. EC2-derived tokens can additionally read credential blobs, exposing TOTP MFA seeds and other secrets. Also, PATCH /v3/credentials does not validate the requested post-update projectid, allowing any delegated token to move a credential to an unauthorized project. All Keystone deployments using delegated authentication are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenStack Keystoneto a version that resolves this vulnerability.Fixed in 29.0.3 - Compensating control
Restrict access to the Keystone endpoint for PATCH /v3/credentials and other /v3/credentials operations so that delegated tokens (EC2-derived tokens, application credentials, OAuth1 access tokens, and trusts) cannot create, modify, or delete credentials via the /v3/credentials API.
Event History
Frequently Asked Questions
Which deployments are exposed?
All Keystone deployments that use delegated authentication are affected. The delegated methods identified are EC2 credentials, application credentials, OAuth1 access tokens, and trusts.
What access does an attacker need to exploit this issue?
An attacker needs a token obtained through a delegated authentication method. Such tokens can create, modify, or delete credentials through the /v3/credentials API, and can move a credential to an unauthorized project using PATCH.
Is sensitive credential material exposed?
Yes, but specifically for EC2-derived tokens. They can read credential blobs, which may expose TOTP MFA seeds and other secrets.
What version contains the fix?
The issue affects Keystone versions before 29.0.3. Upgrading to 29.0.3 or later addresses the affected version range.