EUVD-2026-66118
GHSA-964p-6x56-c2xp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable Keystone API requires a valid delegated token (PR:L); creating persistent credentials causes high confidentiality and integrity impact with no availability effect.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
In OpenStack Keystone before 29.0.3, tokens obtained via OAuth1 access token, application credential, or trust-scoped authentication could create new long-lived credentials or authorize new delegations that persist independently of, and outlive, the credential used to obtain them. The delegation restrictions that block these operations did not consistently apply to all delegated token types, allowing an OAuth1-scoped token, for example, to create application credentials or authorize OAuth1 request tokens despite those operations being restricted for other delegated token types. All Keystone deployments that permit delegated authentication through OAuth1 access tokens, application credentials, or trusts are affected.
AnalysisAI
Privilege escalation in OpenStack Keystone before 29.0.3 allows authenticated users holding delegated tokens - issued via OAuth1 access tokens, application credentials, or trust-scoped authentication - to create new long-lived credentials or authorize additional delegations that outlive the original parent credential. The core security contract of delegation scoping is broken: a derived token can exceed and survive the authority of the credential used to obtain it, because delegation restriction checks were not applied uniformly across all delegated token types. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold a valid token issued via one of three specific Keystone delegated authentication mechanisms: an OAuth1 access token, an application credential, or a trust-scoped token. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.6 (AV:N/AC:L/AT:P/PR:L/UI:N) accurately reflects the attack profile: network-exploitable with low complexity once a delegated credential is held, but gated by AT:P - the attacker must already possess a valid OAuth1, application credential, or trust-scoped token before exploitation is possible. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who holds a legitimate but scoped OAuth1 access token - obtained through normal API authorization flows or by compromising a service account - sends crafted requests to Keystone's application credential or OAuth1 delegation endpoints, which the restriction logic incorrectly permits for delegated token types. The attacker successfully creates a new application credential tied to their user account. … |
| Remediation | The primary fix is upgrading OpenStack Keystone to version 29.0.3 or later, as specified in OSSA-2026-037 (https://security.openstack.org/ossa/OSSA-2026-037.html). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit your OpenStack deployment to determine whether OAuth1 support, application credentials, or trust-scoped authentication are enabled in your Keystone configurations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today