CVE-2026-80183: CWE-843 Access of Resource Using Incompatible Type ('Type Confusion') in OpenStack Keystone

This vulnerability in OpenStack Keystone (CVE-2026-80183) involves a type confusion (CWE-843) where an authenticated user with the 'reader' role on any project can query the GET /v3/role_assignments endpoint with a crafted domain ID as scope.project.id and include_subtree parameter. Due to the domain's project record having domain_id=null, the policy domain_id check incorrectly passes, allowing the user to list every project-scoped role assignment under any domain. Using include_names reveals detailed identity information. The literal 'default' domain ID can be used against deployments created with keystone-manage bootstrap. The root cause is misuse of None in the list_role_assignments_for_tree function. The vulnerability affects versions 16.0.0, 28.0.0, and 29.0.0 of Keystone. No official patch or remediation level is currently documented.

An attacker with minimal privileges (role:reader on any project) can enumerate all project-scoped role assignments across all domains, disclosing sensitive identity and role information including user, group, project, and role names and domain IDs. This unauthorized information disclosure could aid further attacks or privilege escalation attempts within the cloud environment. The vulnerability does not require elevated privileges beyond 'reader' and does not involve direct code execution or data modification.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict the assignment of the 'reader' role to trusted users only and monitor access to the /v3/role_assignments endpoint. Avoid using the 'default' domain ID in deployments where possible. Follow OpenStack Keystone security advisories for updates and apply patches promptly once released.