In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignment under… (CVE-2026-80183)

In OpenStack Keystone prior to version 29.0.3, an authenticated user holding the role 'reader' on any project can exploit a flaw in the GET /v3/role_assignments endpoint. By passing a domain ID as scope.project.id with the include_subtree parameter, the user can bypass domain_id policy checks because the domain's project record has domain_id=null. This allows the user to list every project-scoped role assignment under any domain. Using the include_names parameter, the response reveals the names and home-domain IDs of all users, groups, projects, and roles involved. The vulnerability stems from misuse of a None value in the list_role_assignments_for_tree function. Attackers can harvest domain IDs from responses and iteratively map role assignments across the entire OpenStack cloud deployment.

This vulnerability allows any authenticated user with minimal privileges (role:reader on any project) to enumerate all project-scoped role assignments across all domains in the OpenStack Keystone deployment. This disclosure includes sensitive information such as user, group, project, and role names and their home domain IDs. Such information leakage can aid attackers in reconnaissance and planning further attacks or privilege escalation within the cloud environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict the assignment of the role:reader role to trusted users only and monitor access to the /v3/role_assignments endpoint. Review and tighten Keystone policy configurations to limit exposure of role assignment data where possible.