CVE-2026-80184: CWE-863 Incorrect Authorization in OpenStack Keystone

CVE-2026-80184 is an incorrect authorization vulnerability (CWE-863) in OpenStack Keystone before version 29.0.3. Tokens obtained via delegated authentication mechanisms such as OAuth1 access tokens, application credentials, or trusts can be submitted to the token-method authentication path for reauthentication. When an application credential token is presented without explicit scope, Keystone issues a new token scoped to the credential owner's default project rather than the project for which the credential was issued. This allows an attacker to escape the intended project scope boundary, potentially gaining unauthorized access to resources in the default project.

The vulnerability allows users with delegated authentication tokens to bypass project scope restrictions, potentially accessing resources outside their authorized project boundaries. This could lead to unauthorized access to sensitive data or operations within the default project of the credential owner. The CVSS 4.0 score is 7.6 (high severity), indicating a significant impact with network attack vector, low attack complexity, and partial privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. There is no official fix or patch link provided at this time. Users should monitor OpenStack Keystone vendor advisories for updates and apply patches once available. Until then, consider restricting delegated authentication mechanisms or limiting their use to trusted environments to reduce exposure.