In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms (OAuth1 access tokens, application credentials, trusts)… (CVE-2026-80184)

In OpenStack Keystone before version 29.0.3, a flaw exists in the token-method authentication path that allows tokens obtained via delegated authentication mechanisms (OAuth1 access tokens, application credentials, trusts) to be reauthenticated in a way that escapes their intended project scope. When an application credential token is presented without an explicit scope, Keystone incorrectly issues a new token scoped to the credential owner's default project rather than the project for which the credential was originally issued. This behavior bypasses project boundary restrictions and can lead to unauthorized access within the OpenStack environment. The vulnerability is tracked as CVE-2026-80184 and is categorized under CWE-863 (Incorrect Authorization).

An attacker with delegated authentication tokens can escalate privileges by obtaining tokens scoped to projects they should not have access to, potentially accessing resources outside their authorized project boundaries. This undermines project-level access controls in OpenStack Keystone, leading to unauthorized resource access within affected deployments.

A fix is available in OpenStack Keystone version 29.0.3 that addresses this scope bypass issue. Users should upgrade to version 29.0.3 or later to remediate this vulnerability. Until patched, deployments should carefully review and restrict delegated authentication mechanisms to minimize exposure. Patch status is not explicitly confirmed in the provided data, but the version boundary indicates remediation in 29.0.3.