CVE-2026-90460 describes an incorrect authorization vulnerability (CWE-863) in OpenStack Keystone versions prior to 29.0.3. Delegated authentication tokens—including EC2 credentials, application credentials, OAuth1 access tokens, and trusts—are not properly restricted from managing credentials via the /v3/credentials API. EC2-derived tokens can read credential blobs, exposing multi-factor authentication secrets. The PATCH method on /v3/credentials fails to validate the post-update project_id, enabling unauthorized reassignment of credentials to different projects. This vulnerability impacts all Keystone deployments using delegated authentication methods.

Exploitation of this vulnerability allows attackers with delegated authentication tokens to create, modify, or delete credentials, potentially leading to unauthorized access escalation. EC2-derived tokens can read sensitive credential data, including TOTP MFA seeds, increasing the risk of multi-factor authentication bypass. The ability to move credentials to unauthorized projects can further compromise project isolation and security within OpenStack environments.

A patch is available and should be applied to upgrade OpenStack Keystone to version 29.0.3 or later. Since this is a cloud service, the vendor typically manages remediation server-side; users should verify that their Keystone deployment is updated accordingly. No additional mitigation steps are indicated beyond applying the official fix.