p PatchFirst

CVE-2026-80184

CVE-2026-80184

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms (OAuth1 access tokens, application credentials, trusts) could be submitted to the token-method authentication path for reauthentication to escape their intended project scope. When an application credential token was presented with no explicit scope, Keystone would issue a new token scoped to the credential owner's default project rather than the project for which the credential was issued, bypassing the intended project boundary. All Keystone deployments that permit delegated authentication through OAuth1 access tokens, application credentials, or trusts are affected.

CVSS 7.6 · High · EPSS 0.6% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • keystone

    Versions
    • ≥ 13.0.0, < 27.0.3: Affected (semver)
    • ≥ 28.0.0, < 28.0.3: Affected (semver)
    • ≥ 29.0.0, < 29.0.3: Affected (semver)

    Update to 27.0.3; Update to 28.0.3; Update to 29.0.3

  • keystone Debian:12

    Versions
    • 2:22.0.0-2
    • 2:22.0.2-0+deb12u1
    • 2:22.0.2-0+deb12u2
    • 2:22.0.2-0+deb12u3
    Affected ranges
    • ECOSYSTEM: < 2:22.0.2-0+deb12u4

    Update to 2:22.0.2-0+deb12u4

  • keystone Debian:13

    Versions
    • 2:27.0.0-3
    • 2:27.0.0-3+deb13u1
    • 2:27.0.0-3+deb13u3
    • 2:27.0.0-3+deb13u4
    Affected ranges
    • ECOSYSTEM: < 2:27.0.0-3+deb13u5

    Update to 2:27.0.0-3+deb13u5

  • keystone Debian:14

    Versions
    • 2:27.0.0-3
    • 2:28.0.0-1
    • 2:28.0.0-2
    • 2:28.0.0-3
    • 2:28.0.0-4
    • 2:28.0.0-5
    • 2:28.0.0-6
    • 2:28.0.0~rc1-1
    • 2:28.0.0~rc1-2
    • 2:28.0.0~rc1-4
    • 2:29.0.0-1
    • 2:29.0.0-2
    • 2:29.0.0-3
    • 2:29.0.0~rc1-1
    • 2:29.0.0~rc1-2
    • 2:29.0.1-1
    • 2:29.0.1-2
    Affected ranges
    • ECOSYSTEM: < 2:29.0.2-1

    Update to 2:29.0.2-1

  • keystone Ubuntu:Pro:16.04:LTS

    Versions
    • 2:8.0.0-0ubuntu1
    • 2:9.0.0~b1-0ubuntu1
    • 2:9.0.0~b2-0ubuntu1
    • 2:9.0.0~b3-0ubuntu1
    • 2:9.0.0~rc1-0ubuntu1
    • 2:9.0.0-0ubuntu1
    • 2:9.0.2-0ubuntu1
    • 2:9.0.2-0ubuntu2
    • 2:9.1.0-0ubuntu1
    • 2:9.2.0-0ubuntu1
    • 2:9.3.0-0ubuntu1
    • 2:9.3.0-0ubuntu2
    • 2:9.3.0-0ubuntu3
    • 2:9.3.0-0ubuntu3.1
    • 2:9.3.0-0ubuntu3.2
    Affected ranges
    • ECOSYSTEM: < 2:9.3.0-0ubuntu3.2+esm2

    Update to 2:9.3.0-0ubuntu3.2+esm2

  • keystone Ubuntu:Pro:18.04:LTS

    Versions
    • 2:12.0.0-0ubuntu1
    • 2:13.0.0~b1-0ubuntu1
    • 2:13.0.0~b2-0ubuntu1
    • 2:13.0.0~b3-0ubuntu1
    • 2:13.0.0~rc1-0ubuntu1
    • 2:13.0.0~rc2-0ubuntu1
    • 2:13.0.0-0ubuntu1
    • 2:13.0.1-0ubuntu1
    • 2:13.0.2-0ubuntu1
    • 2:13.0.2-0ubuntu3
    • 2:13.0.4-0ubuntu1
    Affected ranges
    • ECOSYSTEM: < 2:13.0.4-0ubuntu1+esm1

    Update to 2:13.0.4-0ubuntu1+esm1

  • keystone Ubuntu:Pro:20.04:LTS

    Versions
    • 2:16.0.0-0ubuntu1
    • 2:17.0.0~b1~git2019121613.db81fee63-0ubuntu1
    • 2:17.0.0~b2~git2020020513.99733f172-0ubuntu1
    • 2:17.0.0~b3~git2020032415.9f9040257-0ubuntu1
    • 2:17.0.0~b3~git2020032415.9f9040257-0ubuntu2
    • 2:17.0.0~b3~git2020041013.7bb6314e4-0ubuntu1
    • 2:17.0.0-0ubuntu0.20.04.1
    • 2:17.0.1-0ubuntu1
    • 2:17.0.1-0ubuntu2
    • 2:17.0.1-0ubuntu2+esm1
    Affected ranges
    • ECOSYSTEM: < 2:17.0.1-0ubuntu2+esm2

    Update to 2:17.0.1-0ubuntu2+esm2

  • keystone Ubuntu:22.04:LTS

    Versions
    • 2:20.0.0-0ubuntu1
    • 2:20.0.0+git2021120815.2ddf8f321-0ubuntu1
    • 2:20.0.0+git2022011217.771c943ad-0ubuntu1
    • 2:20.0.0+git2022030313.a3fc9e7c3-0ubuntu1
    • 2:21.0.0-0ubuntu1
    • 2:21.0.1-0ubuntu1
    • 2:21.0.1-0ubuntu2
    • 2:21.0.1-0ubuntu2.1
    • 2:21.0.1-0ubuntu2.2
    • 2:21.0.1-0ubuntu2.4
    Affected ranges
    • ECOSYSTEM: < 2:21.0.1-0ubuntu2.6

    Update to 2:21.0.1-0ubuntu2.6

  • keystone Ubuntu:24.04:LTS

    Versions
    • 2:24.0.0-0ubuntu1
    • 2:24.0.0+git2024011916.adfa92b4-0ubuntu1
    • 2:25.0.0~rc1-0ubuntu1
    • 2:25.0.0-0ubuntu1
    • 2:25.0.0-0ubuntu1.1
    • 2:25.0.0-0ubuntu1.2
    • 2:25.0.0-0ubuntu1.4
    Affected ranges
    • ECOSYSTEM: < 2:25.0.0-0ubuntu1.6

    Update to 2:25.0.0-0ubuntu1.6

  • keystone Ubuntu:26.04:LTS

    Versions
    • 2:28.0.0-0ubuntu1
    • 2:28.0.0-0ubuntu2
    • 2:28.0.0+git20260119.61.8a42793e7-0ubuntu1
    • 2:29.0.0~rc1-0ubuntu1
    • 2:29.0.0-0ubuntu1
    • 2:29.0.0-0ubuntu1.2
    Affected ranges
    • ECOSYSTEM: < 2:29.0.0-0ubuntu1.4

    Update to 2:29.0.0-0ubuntu1.4

Original sources

Check your server →