An issue was discovered in OpenStack Keystone before 29.0.3. (CVE-2026-90460)
OpenStack Keystone versions prior to 29.0.3 have a vulnerability in delegated authentication tokens that allows unauthorized creation, modification, or deletion of credentials via the /v3/credentials API. EC2-derived tokens can also read sensitive credential blobs, exposing TOTP MFA seeds and other secrets. Additionally, the PATCH /v3/credentials endpoint does not validate post-update project_id, enabling delegated tokens to move credentials to unauthorized projects. This affects all Keystone deployments using delegated authentication.
AI Analysis
Technical Summary
CVE-2026-90460 describes a vulnerability in OpenStack Keystone before version 29.0.3 where tokens obtained through delegated authentication methods (including EC2 credentials, application credentials, OAuth1 access tokens, and trusts) are not properly restricted from managing credentials via the /v3/credentials API. EC2-derived tokens can read credential blobs, exposing sensitive data such as TOTP MFA seeds. The PATCH method on /v3/credentials lacks validation of the project_id parameter, allowing unauthorized reassignment of credentials. This issue impacts all Keystone deployments that use delegated authentication.
Potential Impact
An attacker with delegated authentication tokens can create, modify, or delete credentials without proper authorization. EC2-derived tokens can also read sensitive credential data, including MFA secrets, increasing the risk of further compromise. The ability to move credentials to unauthorized projects can lead to privilege escalation or unauthorized access within the OpenStack environment.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict or monitor the use of delegated authentication tokens and limit exposure of the /v3/credentials API. Avoid using EC2-derived tokens where possible and review credential management policies.
An issue was discovered in OpenStack Keystone before 29.0.3. (CVE-2026-90460)
Description
OpenStack Keystone versions prior to 29.0.3 have a vulnerability in delegated authentication tokens that allows unauthorized creation, modification, or deletion of credentials via the /v3/credentials API. EC2-derived tokens can also read sensitive credential blobs, exposing TOTP MFA seeds and other secrets. Additionally, the PATCH /v3/credentials endpoint does not validate post-update project_id, enabling delegated tokens to move credentials to unauthorized projects. This affects all Keystone deployments using delegated authentication.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-90460 describes a vulnerability in OpenStack Keystone before version 29.0.3 where tokens obtained through delegated authentication methods (including EC2 credentials, application credentials, OAuth1 access tokens, and trusts) are not properly restricted from managing credentials via the /v3/credentials API. EC2-derived tokens can read credential blobs, exposing sensitive data such as TOTP MFA seeds. The PATCH method on /v3/credentials lacks validation of the project_id parameter, allowing unauthorized reassignment of credentials. This issue impacts all Keystone deployments that use delegated authentication.
Potential Impact
An attacker with delegated authentication tokens can create, modify, or delete credentials without proper authorization. EC2-derived tokens can also read sensitive credential data, including MFA secrets, increasing the risk of further compromise. The ability to move credentials to unauthorized projects can lead to privilege escalation or unauthorized access within the OpenStack environment.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict or monitor the use of delegated authentication tokens and limit exposure of the /v3/credentials API. Avoid using EC2-derived tokens where possible and review credential management policies.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-qfjc-4hpf-mgw2
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-90460"]
- Database Specific Severity
- HIGH
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aa4b38955bf5e2cf5baf6c7
Added to database: 09/12/2026, 02:06:01 UTC
Last enriched: 09/12/2026, 02:16:29 UTC
Last updated: 09/12/2026, 03:01:32 UTC
Views: 20
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.