https://seclists.org/oss-sec/2026/q3/577: [OSSA-2026-037] OpenStack Keystone: Inconsistent scope enforcement for delegated tokens (CVE-2026-80182, CVE-2026-80184)

Q: Which Keystone versions are affected?

Affected versions are Keystone 13.0.0 through before 27.0.3, 28.0.0 through before 28.0.3, and 29.0.0 through before 29.0.3.

Q: What type of credential would an attacker need to exploit these issues?

The attacker would need a token obtained through an OAuth1 access token, an application credential, or a trust. Such delegated tokens could be used to create credentials or delegations that persist independently of the original delegated credential.

Q: How could an application-credential token gain a different project scope?

A token obtained through an application credential could be submitted to Keystone's token-method authentication path without an explicit scope. Keystone would then issue a new token scoped to the application credential owner's default project.

Published Aug 25, 2026

Updated

Affected Software

1 affected component

Openstack Keystone>13.0.0<27.0.3, >28.0.0<28.0.3, >29.0.0<29.0.3

Frequently Asked Questions

Which Keystone versions are affected?

Affected versions are Keystone 13.0.0 through before 27.0.3, 28.0.0 through before 28.0.3, and 29.0.0 through before 29.0.3.

What type of credential would an attacker need to exploit these issues?

The attacker would need a token obtained through an OAuth1 access token, an application credential, or a trust. Such delegated tokens could be used to create credentials or delegations that persist independently of the original delegated credential.

How could an application-credential token gain a different project scope?

A token obtained through an application credential could be submitted to Keystone's token-method authentication path without an explicit scope. Keystone would then issue a new token scoped to the application credential owner's default project.