Skip to main content

OpenStack Keystone CVE-2026-80184

| EUVDEUVD-2026-66121 HIGH
Incorrect Authorization (CWE-863)
2026-08-25 cve@mitre.org GHSA-x764-fvmq-4x2r
Authentication Bypass
7.6
CVSS 4.0 · Vendor: mitre
Share

Severity by source

Vendor (mitre) PRIMARY
7.6 HIGH
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.6 CRITICAL

Network-exploitable by any low-privilege authenticated user with a delegated credential; scope changes because the attacker escapes their authorized project boundary into a separate authorization domain.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Aug 25, 2026 - 23:19 EUVD
Analysis Generated
Aug 25, 2026 - 22:37 vuln.today
CVE Published
Aug 25, 2026 - 22:17 cve.org
HIGH 7.6

DescriptionCVE.org

In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms (OAuth1 access tokens, application credentials, trusts) could be submitted to the token-method authentication path for reauthentication to escape their intended project scope. When an application credential token was presented with no explicit scope, Keystone would issue a new token scoped to the credential owner's default project rather than the project for which the credential was issued, bypassing the intended project boundary. All Keystone deployments that permit delegated authentication through OAuth1 access tokens, application credentials, or trusts are affected.

AnalysisAI

Project scope bypass in OpenStack Keystone before 29.0.3 allows authenticated users holding delegated credentials - OAuth1 access tokens, application credentials, or trusts - to escape their intended project authorization boundary by submitting these tokens to the standard token-method authentication endpoint for reauthentication. When an application credential token is presented without an explicit scope parameter, Keystone incorrectly resolves scope to the credential owner's default project rather than the project for which the credential was originally issued, granting unintended cross-project access. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain valid delegated credential token (OAuth1/application credential/trust)
Delivery
Submit token to /v3/auth/tokens using token-method auth
Exploit
Omit explicit project scope from request
Execution
Keystone resolves scope to credential owner's default project
Persist
Receive unauthorized project-scoped token
Impact
Access or modify resources in unintended target project
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The attacker must hold a valid delegated authentication token within the target Keystone deployment - specifically an OAuth1 access token, an application credential token, or a trust-derived token. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 7.6 with vector AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N is well-calibrated for this flaw: network-reachable and low-complexity, but gated by AT:P indicating the attacker must already hold a valid delegated credential and PR:L confirming authenticated access is required. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker holding a valid application credential scoped to Project A - obtained legitimately as part of a service account or through credential theft - submits that credential token to the /v3/auth/tokens endpoint using the token authentication method, deliberately omitting the scope field from the request body. Keystone issues a new token scoped to the credential owner's default project (Project B), which the attacker was never authorized to access. …
Remediation Upgrade OpenStack Keystone to version 29.0.3 or later, as confirmed by OpenStack Security Advisory OSSA-2026-037 at https://security.openstack.org/ossa/OSSA-2026-037.html and the oss-security announcement dated 2026-08-25. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all delegated credentials in use (OAuth1 tokens, application credentials, trusts) and enable detailed API logging for token reauthentication events to establish baseline behavior. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-863 – Incorrect Authorization

View all
CVE-2025-54253 CRITICAL POC
10.0
CVE-2025-24200 MEDIUM
6.1
CVE-2023-21715 HIGH
7.3
CVE-2025-21480 HIGH
8.6
CVE-2025-21479 HIGH
8.6
CVE-2025-32462 HIGH POC
8.8
CVE-2017-4915 HIGH POC
7.8
CVE-2024-6782 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-80184 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy