Skip to main content

OpenStack Keystone EUVDEUVD-2026-66818

| CVE-2026-80183 HIGH
Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)
2026-08-26 mitre GHSA-xmh6-7768-658c
Memory Corruption Information Disclosure Keystone
7.1
CVSS 4.0 · Vendor: mitre
Share

Severity by source

Vendor (mitre) PRIMARY
7.1 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.5 MEDIUM

Network-accessible API endpoint requiring only role:reader (PR:L); null domain_id bypass fully discloses role assignment data across domains (C:H); no integrity or availability impact applies.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Aug 27, 2026 - 04:15 EUVD
Analysis Generated
Aug 27, 2026 - 00:43 vuln.today
CVE Published
Aug 26, 2026 - 23:16 cve.org
HIGH 7.1

DescriptionCVE.org

In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignment under any domain by passing a domain ID as scope.project.id with include_subtree to the GET /v3/role_assignments endpoint. The domain's project record has domain_id=null, causing the policy domain_id check to pass for any caller. With include_names, the response discloses the names and home-domain IDs of every user, group, project, and role involved. The literal "default" domain ID works against any deployment created with keystone-manage bootstrap. An attacker can harvest domain IDs from the response and repeat the query to map role assignments across the entire cloud. This is caused by misuse of "None" in

list_role_assignments_for_tree.

AnalysisAI

OpenStack Keystone before 29.0.3 allows any authenticated user holding role:reader on any project to enumerate all role assignments across any domain in the cloud by exploiting a type-confusion bug in the GET /v3/role_assignments endpoint. The attack supplies a domain ID as scope.project.id with include_subtree, triggering a null domain_id policy check that passes unconditionally for all callers because domains are internally modeled as projects with domain_id=null. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain role:reader token on any project
Delivery
Send GET /v3/role_assignments with domain ID as scope.project.id and include_subtree=true
Exploit
Null domain_id policy check passes for any authenticated caller
Execution
Receive full role assignment list with user, group, and project names via include_names
Persist
Extract additional domain IDs from response
Impact
Repeat query iteratively across all domains to map entire cloud identity topology
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The attacker must hold a valid Keystone authentication token with role:reader on any project in the target OpenStack deployment - the minimum non-guest privilege level, commonly granted to ordinary tenants in multi-tenant clouds. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N, score 7.1) accurately reflects the threat profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who has obtained a minimal OpenStack user account - such as a shared-tenant account in a public cloud or a compromised service account - authenticates to Keystone and obtains a project-scoped token with role:reader. The attacker sends GET /v3/role_assignments?scope.project.id=default&include_subtree=true&include_names=true using the well-known 'default' domain ID constant, receiving a full role assignment listing for the default domain including user names, group names, and home-domain IDs. …
Remediation The primary fix is to upgrade OpenStack Keystone to version 29.0.3 or later, which corrects the null domain_id handling in list_role_assignments_for_tree. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, audit Keystone access logs for suspicious queries to /v3/role_assignments with include_names or include_subtree parameters; escalate any findings for immediate credential reset and compromise investigation. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Keystone

View all
CVE-2017-15879 HIGH POC
8.8 Oct 24

CSV Injection (aka Excel Macro Injection or Formula Injection) exists in admin/server/api/download.js and lib/list/getCS
CVE-2022-39382 CRITICAL POC
9.8 Nov 03

Keystone is a headless CMS for Node.js - built with GraphQL and React.`@keystone-6/core@3.0.0 || 3.0.1` users that use `
CVE-2022-39322 CRITICAL POC
9.8 Oct 25

@keystone-6/core is a core package for Keystone 6, a content management system for Node.js. Rated critical severity (CVS
CVE-2022-29354 CRITICAL POC
9.8 May 16

An arbitrary file upload vulnerability in the file upload module of Keystone v4.2.1 allows attackers to execute arbitrar
CVE-2017-16570 HIGH POC
8.8 Nov 06

KeystoneJS before 4.0.0-beta.7 allows application-wide CSRF bypass by removing the CSRF parameter and value, aka SecureL
CVE-2019-19687 HIGH POC
8.8 Dec 09

OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Rated high severity (CVSS

CVE-2026-63421 HIGH POC
7.5 Aug 21

Unauthenticated resource exhaustion in Keystone CMS (Node.js) prior to version 6.5.3 allows any remote GraphQL client to
CVE-2021-38155 HIGH POC
7.5 Aug 06

OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allow
CVE-2017-15878 MEDIUM POC
6.1 Oct 24

A cross-site scripting (XSS) vulnerability exists in fields/types/markdown/MarkdownType.js in KeystoneJS before 4.0.0-be
CVE-2022-2447 MEDIUM POC
6.6 Sep 01

A flaw was found in Keystone. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable. Public explo
CVE-2014-3520 MEDIUM POC
6.5 Oct 26

OpenStack Identity (Keystone) before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2 allows remote authenticate
CVE-2014-0204 MEDIUM POC
6.5 Nov 03

OpenStack Identity (Keystone) before 2014.1.1 does not properly handle when a role is assigned to a group that has the s

Same weakness CWE-843 – Access of Resource Using Incompatible Type (Type Confusion)

View all
CVE-2011-0611 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2017-8291 HIGH POC
7.8
CVE-2016-7201 HIGH POC
8.8
CVE-2017-0037 HIGH POC
8.1
CVE-2019-0752 HIGH POC
7.5
CVE-2017-5070 HIGH POC
8.8
CVE-2025-30397 HIGH POC
7.5

Same technique Memory Corruption

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8

Share

EUVD-2026-66818 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy