Bug 2517801 (CVE-2026-80182)

Summary: CVE-2026-80182 keystone: keystone: Delegated token scope restrictions not consistently enforced across trust, OAuth1, and application credential endpoints
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: carnil, eglynn, jjoyce, jpretori, jschluet, lhh, mburns, mgarciac, prodsec-ir-bot, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---Flags: carnil: needinfo? (prodsec-ir-bot)
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in OpenStack Keystone where delegation boundary enforcement is incomplete across trust, application credential, and OAuth1 authorization endpoints. Tokens obtained via delegated authentication methods, such as OAuth1 access tokens or custom Keystone authentication plugins, can perform operations beyond their intended scope because endpoint guards only recognized specific delegation types rather than using a comprehensive allowlist. This allows creating trusts that delegate roles beyond the token's authorized scope, creating persistent application credentials, and authorizing new OAuth1 delegations. These derived credentials persist independently and survive revocation of the original credential, enabling an attacker with a compromised narrow-scope credential to escalate to the user's full privileges and maintain persistent access.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Deadline: 2026-08-25   

Description OSIDB Bzimport 2026-08-18 12:11:29 UTC 
OpenStack Keystone provides authentication, authorization, and service discovery for OpenStack. Grzegorz Grasza (Red Hat) and Tim Shephard (roiai.ca) independently identified that Keystone does not consistently enforce scope restrictions on tokens obtained via delegated authentication methods (ec2credential, application credential, OAuth1 access tokens).

This flaw covers Launchpad #2153453 (delegation bypass in trust, OAuth1, and application credential operations). In keystone/api/trusts.py, _check_application_credential() only checked for 'application_credential' in token.methods, allowing EC2 credential tokens (methods: ['ec2credential']) and OAuth1 tokens (methods: ['oauth1']) to perform trust CRUD operations. Similarly, _block_delegated_token_app_creds() in keystone/api/users.py only checked trust_id and access_token_id attributes, allowing EC2 tokens to manage application credentials. AuthorizeResource.put in keystone/api/os_oauth1.py checked ctx.is_delegated_auth and 'application_credential' in methods, but EC2 tokens set neither flag. Trust role validation in _get_trustor_roles() checks the trustor's full role assignments rather than the token's scoped roles, enabling role escalation.

An attacker with a limited-scope EC2 or OAuth1 credential can create trusts that delegate the user's full role set, create persistent application credentials, and authorize new OAuth1 delegations. Those derived credentials survive revocation of the original delegated credential.

Upstream affected range: Keystone >=13.0.0 through unfixed 27.x, 28.x, and 29.x releases. Proposed patches use a _PRIMARY_AUTH_METHODS allowlist and reject tokens whose methods are not entirely in that set. On current master, a separate middleware guard in auth_context.py globally rejects EC2 credential tokens from API authorization, but that guard is not present on stable branches.

CVE IDs have been requested by the OpenStack Vulnerability Management Team and are not yet assigned (CVE-2026-pending).
Reporter: Grzegorz Grasza (Red Hat) and Tim Shephard (roiai.ca). Coordinated by Goutham Pacha Ravi, OpenStack VMT.
Private Launchpad report: https://launchpad.net/bugs/2153453
PSIRT Ticket: PSIRTSUPT-21454
Comment 1 Salvatore Bonaccorso 2026-08-26 07:07:51 UTC 
I think this CVE is wrong, this should be CVE-2026-80182 ?