In OpenStack Keystone before 29.0.3, tokens obtained via OAuth1 access token, application credential, or trust-scoped authentication could create… (CVE-2026-80182)

In OpenStack Keystone before version 29.0.3, tokens obtained through OAuth1 access tokens, application credentials, or trust-scoped authentication could bypass delegation restrictions. This flaw allows such tokens to create new long-lived credentials or authorize new delegations that outlive the original credential used to obtain them. The inconsistency in applying delegation restrictions across delegated token types means, for example, an OAuth1-scoped token can create application credentials or authorize OAuth1 request tokens despite these operations being restricted for other token types. This affects all Keystone deployments that allow delegated authentication via these token types.

An attacker with a delegated token obtained via OAuth1 access token, application credential, or trust-scoped authentication could create new long-lived credentials or authorize new delegations that persist beyond the lifetime of the original token. This could lead to unauthorized privilege escalation or persistence within the OpenStack Keystone environment. The vulnerability undermines the intended delegation restrictions, potentially allowing unauthorized access or actions.

A fix is available in OpenStack Keystone version 29.0.3. Users should upgrade to version 29.0.3 or later to address this vulnerability. Until patched, deployments should carefully review and potentially restrict delegated authentication methods involving OAuth1 access tokens, application credentials, or trusts to minimize exposure.