OpenStack Keystone EUVD-2026-66818

The attacker must hold a valid Keystone authentication token with role:reader on any project in the target OpenStack deployment - the minimum non-guest privilege level, commonly granted to ordinary tenants in multi-tenant clouds. No administrative rights, domain-scoped roles, or elevated permissions beyond role:reader are required. Crucially, the attack against the 'default' domain requires no prior knowledge of domain IDs - the literal string 'default' is a universal constant present in every deployment initialized with keystone-manage bootstrap, which covers virtually all standard OpenStack installations. Non-default domains require a domain ID, but these can be iteratively harvested from the initial default-domain response, removing this as a meaningful barrier after the first query. The flaw is limited to read-only enumeration - exploitation grants no write access, no privilege escalation, and no availability impact. The only meaningful limiting factor is the requirement for PR:L authentication; fully unauthenticated attackers cannot exploit this flaw.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N, score 7.1) accurately reflects the threat profile. The network attack vector and low attack complexity are confirmed: any HTTP client with a valid token can reach the endpoint. PR:L is correct - role:reader is the minimum non-guest privilege in Keystone, making the authentication bar extremely low in any multi-tenant environment. VC:H is warranted because a single successful request against the default domain can return the complete role assignment graph for all principals in that domain, with iterative queries revealing the entire cloud identity topology. SC:L captures that downstream systems consuming Keystone identity data (Nova, Neutron, Swift, etc.) may be indirectly exposed through the disclosed privilege map. Key risk amplifiers: the 'default' domain ID is a known constant (not a secret), so an attacker with any low-privilege token needs no prior reconnaissance to launch the attack. The iterative harvest mechanic - where each response yields new domain IDs to query - means a single entry point can enumerate the entire cloud. Risk mitigators: exploitation requires a valid authenticated token (PR:L); no KEV listing and no identified POC reduce immediate threat urgency. EPSS data was not available in the provided intelligence. The 'Memory Corruption' tag should not factor into risk scoring - the actual impact is information disclosure only.

An attacker who has obtained a minimal OpenStack user account - such as a shared-tenant account in a public cloud or a compromised service account - authenticates to Keystone and obtains a project-scoped token with role:reader. The attacker sends GET /v3/role_assignments?scope.project.id=default&include_subtree=true&include_names=true using the well-known 'default' domain ID constant, receiving a full role assignment listing for the default domain including user names, group names, and home-domain IDs. The attacker iterates over the returned domain IDs to repeat the query, progressively constructing a complete map of role assignments across all domains in the cloud - without ever requiring administrative credentials. No public exploit code has been identified at time of analysis.