https://seclists.org/oss-sec/2026/q3/573: [OSSA-2026-037] OpenStack Keystone: Inconsistent scope enforcement for delegated tokens (CVE-2026-pending)

Q: Which Keystone releases need remediation?

Affected releases are Keystone >=13.0.0 and <27.0.3, >=28.0.0 and <28.0.3, and >=29.0.0 and <29.0.3.

Q: Which delegation mechanisms can be used in the affected flows?

The affected delegated-token flows include tokens scoped through an OAuth1 access token, an application credential, or a trust.

Q: What can an attacker retain after using a delegated token?

A delegated token could create long-lived credentials or authorize new delegations. Those newly created credentials or delegations can persist independently of, and outlive, the credential used to obtain them.

Q: When can an application credential token escape its intended project scope?

When an application credential token is submitted to the token-method authentication path without an explicit scope, Keystone can issue a new token scoped to the credential owner's default project.

Published Aug 25, 2026

Updated

Affected Software

1 affected component

Openstack Keystone>13.0.0<27.0.3, >28.0.0<28.0.3, >29.0.0<29.0.3

Frequently Asked Questions

Which Keystone releases need remediation?

Affected releases are Keystone >=13.0.0 and <27.0.3, >=28.0.0 and <28.0.3, and >=29.0.0 and <29.0.3.

Which delegation mechanisms can be used in the affected flows?

The affected delegated-token flows include tokens scoped through an OAuth1 access token, an application credential, or a trust.

What can an attacker retain after using a delegated token?

A delegated token could create long-lived credentials or authorize new delegations. Those newly created credentials or delegations can persist independently of, and outlive, the credential used to obtain them.

When can an application credential token escape its intended project scope?

When an application credential token is submitted to the token-method authentication path without an explicit scope, Keystone can issue a new token scoped to the credential owner's default project.