Summary
Grzegorz Grasza discovered that OpenStack Keystone did not consistently
enforce restrictions for delegated authentication tokens. An authenticated
attacker could possibly use this issue to create credentials or delegations
that outlasted the delegated token. (CVE-2026-80182)
It was discovered that OpenStack Keystone incorrectly handled role
assignment queries under certain circumstances. An authenticated attacker
could possibly use this issue to obtain sensitive information. This
issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04
LTS, and Ubuntu 26.04 LTS. (CVE-2026-80183)
Tim Shephard discovered that OpenStack Keystone did not properly
restrict reauthentication using delegated tokens. An authenticated
attacker could possibly use this issue to escape their intended
project scope and obtain unauthorized access. (CVE-2026-80184)
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | keystone | 2:21.0.1-0ubuntu2.6 |
| Ubuntu · 24.04 LTS 24.04:LTS | keystone | 2:25.0.0-0ubuntu1.6 |
| Ubuntu · 26.04 LTS 26.04:LTS | keystone | 2:29.0.0-0ubuntu1.4 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | keystone | 2:9.3.0-0ubuntu3.2+esm2 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | keystone | 2:13.0.4-0ubuntu1+esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | keystone | 2:17.0.1-0ubuntu2+esm2 |
Vulnerabilities 3
-
High 7.6
In OpenStack Keystone before 29.0.3, tokens obtained via OAuth1 access token, application credential, or trust-scoped a…
-
High 7.6
In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms (OAuth1 access tokens, app…
-
High 7.1
In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-s…