p PatchFirst

CVE-2026-80183

CVE-2026-80183

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignment under any domain by passing a domain ID as scope.project.id with include_subtree to the GET /v3/role_assignments endpoint. The domain's project record has domain_id=null, causing the policy domain_id check to pass for any caller. With include_names, the response discloses the names and home-domain IDs of every user, group, project, and role involved. The literal "default" domain ID works against any deployment created with keystone-manage bootstrap. An attacker can harvest domain IDs from the response and repeat the query to map role assignments across the entire cloud. This is caused by misuse of "None" in  list_role_assignments_for_tree.

CVSS 7.1 · High · EPSS 0.4% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • keystone

    Versions
    • ≥ 16.0.0, < 27.0.3: Affected (semver)
    • ≥ 28.0.0, < 28.0.3: Affected (semver)
    • ≥ 29.0.0, < 29.0.3: Affected (semver)

    Update to 27.0.3; Update to 28.0.3; Update to 29.0.3

  • keystone Debian:12

    Versions
    • 2:22.0.0-2
    • 2:22.0.2-0+deb12u1
    • 2:22.0.2-0+deb12u2
    • 2:22.0.2-0+deb12u3
    Affected ranges
    • ECOSYSTEM: < 2:22.0.2-0+deb12u4

    Update to 2:22.0.2-0+deb12u4

  • keystone Debian:13

    Versions
    • 2:27.0.0-3
    • 2:27.0.0-3+deb13u1
    • 2:27.0.0-3+deb13u3
    • 2:27.0.0-3+deb13u4
    Affected ranges
    • ECOSYSTEM: < 2:27.0.0-3+deb13u5

    Update to 2:27.0.0-3+deb13u5

  • keystone Debian:14

    Versions
    • 2:27.0.0-3
    • 2:28.0.0-1
    • 2:28.0.0-2
    • 2:28.0.0-3
    • 2:28.0.0-4
    • 2:28.0.0-5
    • 2:28.0.0-6
    • 2:28.0.0~rc1-1
    • 2:28.0.0~rc1-2
    • 2:28.0.0~rc1-4
    • 2:29.0.0-1
    • 2:29.0.0-2
    • 2:29.0.0-3
    • 2:29.0.0~rc1-1
    • 2:29.0.0~rc1-2
    • 2:29.0.1-1
    • 2:29.0.1-2
    • 2:29.0.2-1
    Affected ranges
    • ECOSYSTEM: < 2:29.0.2-2

    Update to 2:29.0.2-2

  • keystone Ubuntu:Pro:20.04:LTS

    Versions
    • 2:16.0.0-0ubuntu1
    • 2:17.0.0~b1~git2019121613.db81fee63-0ubuntu1
    • 2:17.0.0~b2~git2020020513.99733f172-0ubuntu1
    • 2:17.0.0~b3~git2020032415.9f9040257-0ubuntu1
    • 2:17.0.0~b3~git2020032415.9f9040257-0ubuntu2
    • 2:17.0.0~b3~git2020041013.7bb6314e4-0ubuntu1
    • 2:17.0.0-0ubuntu0.20.04.1
    • 2:17.0.1-0ubuntu1
    • 2:17.0.1-0ubuntu2
    • 2:17.0.1-0ubuntu2+esm1
    Affected ranges
    • ECOSYSTEM: < 2:17.0.1-0ubuntu2+esm2

    Update to 2:17.0.1-0ubuntu2+esm2

  • keystone Ubuntu:22.04:LTS

    Versions
    • 2:20.0.0-0ubuntu1
    • 2:20.0.0+git2021120815.2ddf8f321-0ubuntu1
    • 2:20.0.0+git2022011217.771c943ad-0ubuntu1
    • 2:20.0.0+git2022030313.a3fc9e7c3-0ubuntu1
    • 2:21.0.0-0ubuntu1
    • 2:21.0.1-0ubuntu1
    • 2:21.0.1-0ubuntu2
    • 2:21.0.1-0ubuntu2.1
    • 2:21.0.1-0ubuntu2.2
    • 2:21.0.1-0ubuntu2.4
    Affected ranges
    • ECOSYSTEM: < 2:21.0.1-0ubuntu2.6

    Update to 2:21.0.1-0ubuntu2.6

  • keystone Ubuntu:24.04:LTS

    Versions
    • 2:24.0.0-0ubuntu1
    • 2:24.0.0+git2024011916.adfa92b4-0ubuntu1
    • 2:25.0.0~rc1-0ubuntu1
    • 2:25.0.0-0ubuntu1
    • 2:25.0.0-0ubuntu1.1
    • 2:25.0.0-0ubuntu1.2
    • 2:25.0.0-0ubuntu1.4
    Affected ranges
    • ECOSYSTEM: < 2:25.0.0-0ubuntu1.6

    Update to 2:25.0.0-0ubuntu1.6

  • keystone Ubuntu:26.04:LTS

    Versions
    • 2:28.0.0-0ubuntu1
    • 2:28.0.0-0ubuntu2
    • 2:28.0.0+git20260119.61.8a42793e7-0ubuntu1
    • 2:29.0.0~rc1-0ubuntu1
    • 2:29.0.0-0ubuntu1
    • 2:29.0.0-0ubuntu1.2
    Affected ranges
    • ECOSYSTEM: < 2:29.0.0-0ubuntu1.4

    Update to 2:29.0.0-0ubuntu1.4

Original sources

Check your server →