CVE-2026-80182: CWE-863 Incorrect Authorization in OpenStack Keystone

OpenStack Keystone versions prior to 29.0.3 contain an authorization flaw (CWE-863) where tokens obtained via OAuth1 access token, application credential, or trust-scoped authentication can create new long-lived credentials or authorize new delegations that persist beyond the lifetime of the original credential. The delegation restrictions intended to block such operations are inconsistently enforced across delegated token types, allowing, for example, an OAuth1-scoped token to create application credentials or authorize OAuth1 request tokens despite these operations being restricted for other delegated token types. This issue affects all Keystone deployments that allow delegated authentication via these token types.

An attacker with a delegated token (OAuth1 access token, application credential, or trust-scoped authentication) can create new long-lived credentials or authorize new delegations that persist independently of the original token. This can lead to unauthorized privilege escalation and extended access beyond the intended scope and lifetime of the original credentials, potentially compromising the security of the OpenStack environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is explicitly stated in the provided data. Until a patch is available, administrators should carefully review and possibly restrict the use of delegated authentication via OAuth1 access tokens, application credentials, or trusts to mitigate risk.