CVE catalog

CVE-2026-90460

An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods (EC2 credentials, application credentials, OAuth1 access tokens, and trusts) are not b

[CVE catalog]

Severity
High · CVSS 7.6CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.57% · Oct 25, 2026

An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods (EC2 credentials, application credentials, OAuth1 access tokens, and trusts) are not blocked from creating, modifying, or deleting credentials via the /v3/credentials API. EC2-derived tokens can additionally read credential blobs, exposing TOTP MFA seeds and other secrets. Also, PATCH /v3/credentials does not validate the requested post-update project_id, allowing any delegated token to move a credential to an unauthorized project. All Keystone deployments using delegated authentication are affected.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiankeystonesid2:30.0.0-3fixed
Debiankeystoneforky2:30.0.0-3fixed
Debiankeystonetrixie2:27.0.0-3+deb13u5vulnerable
Debiankeystonetrixie-security2:27.0.0-3+deb13u6fixed
Debiankeystonebookworm2:22.0.2-0+deb12u3vulnerable
Debiankeystonebookworm-security2:22.0.2-0+deb12u6fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiankeystonesourcesid2:30.0.0~rc1-1not yet assignedNot reported[1149956]
Debiankeystonesourceforky2:30.0.0~rc1-1not yet assignedNot reported[1149956]
Debiankeystonesourcetrixie2:27.0.0-3+deb13u6not yet assignedNot reported[1149956]
Debiankeystonesourcebookworm2:22.0.2-0+deb12u5not yet assignedNot reported[1149956]

[Debian bug #1149956]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [keystone]Affected
    Details (4)

    • 2:22.0.2-0+deb12u3 · all · bookworm

      Affected · Fixed: 2:22.0.2-0+deb12u5

      nvd · keystone · debian · bookworm

    • 2:22.0.2-0+deb12u3 · all · bookworm

      Affected · Fixed: 2:22.0.2-0+deb12u5

      nvd · keystone · debian · bookworm

    • 2:22.0.2-0+deb12u3 · all · bookworm-security

      Affected · Fixed: 2:22.0.2-0+deb12u5

      nvd · keystone · debian · bookworm

    • 2:22.0.2-0+deb12u3 · all · bookworm-security

      Affected · Fixed: 2:22.0.2-0+deb12u5

      nvd · keystone · debian · bookworm

  • [keystone-doc]Affected

    Source package: [keystone]

    Details (4)

    • 2:22.0.2-0+deb12u3 · all · bookworm

      Affected · Fixed: 2:22.0.2-0+deb12u5

      nvd · keystone · debian · bookworm

    • 2:22.0.2-0+deb12u3 · all · bookworm

      Affected · Fixed: 2:22.0.2-0+deb12u5

      nvd · keystone · debian · bookworm

    • 2:22.0.2-0+deb12u3 · all · bookworm-security

      Affected · Fixed: 2:22.0.2-0+deb12u5

      nvd · keystone · debian · bookworm

    • 2:22.0.2-0+deb12u3 · all · bookworm-security

      Affected · Fixed: 2:22.0.2-0+deb12u5

      nvd · keystone · debian · bookworm

  • [python3-keystone]Affected

    Source package: [keystone]

    Details (4)

    • 2:22.0.2-0+deb12u3 · all · bookworm

      Affected · Fixed: 2:22.0.2-0+deb12u5

      nvd · keystone · debian · bookworm

    • 2:22.0.2-0+deb12u3 · all · bookworm

      Affected · Fixed: 2:22.0.2-0+deb12u5

      nvd · keystone · debian · bookworm

    • 2:22.0.2-0+deb12u3 · all · bookworm-security

      Affected · Fixed: 2:22.0.2-0+deb12u5

      nvd · keystone · debian · bookworm

    • 2:22.0.2-0+deb12u3 · all · bookworm-security

      Affected · Fixed: 2:22.0.2-0+deb12u5

      nvd · keystone · debian · bookworm

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [Red Hat security advisories and VEX]