Bug 2559580 (CVE-2026-115642)

Summary:	CVE-2026-115642 keystonemiddleware: keystonemiddleware: application credential access_rules bypass via X-Service-Token header presence check
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	akhatavk, aos-team-art-private, asdas, dpaolell, eglynn, jdelft, jjoyce, jpretori, jschluet, jupierce, lgarciaa, lhh, mbiarnes, mburns, mgarciac, ppalepu, ppostler, prdhamdh, security-response-team, sghai, sidsharm, suppawar, vlaad
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in OpenStack keystonemiddleware and Keystone. The code incorrectly treats the presence of the X-Service-Token HTTP header as sufficient to skip enforcement of application credential access rules (and can skip related token-binding checks). An attacker who holds an application credential with access_rules can bypass those restrictions by sending any non-empty X-Service-Token value; a valid service token is not required for this bypass when delay_auth_decision is enabled (typical). This allows API calls beyond what the credential was designed to permit within the attacker's existing roles. Only installing fixed keystonemiddleware and Keystone packages remediates the issue.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Deadline:	2026-10-29

Description OSIDB Bzimport 2026-10-23 12:13:12 UTC

keystonemiddleware provides the auth_token WSGI middleware used by all OpenStack services to validate Keystone tokens. Application credentials can carry access_rules that restrict which HTTP methods and API paths the bearer may call.

The vulnerability is in BaseAuthProtocol.validate_allowed_request() in keystonemiddleware/auth_token/__init__.py (lines 592-596). The guard uses request.service_token (raw X-Service-Token header presence) instead of request.service_token_valid (validated service token) to skip access_rules enforcement. A secondary instance at line 420-421 skips _confirm_token_bind() under the same mistaken header-presence check.

Upstream affected version ranges (embargo): < 10.12.2, >= 11.0.0 < 12.0.1, >= 13.0.0 < 13.0.2. Proposed fixes on master (2027.1) and stable branches 2026.2, 2026.1, 2025.2, 2025.1. Launchpad #2162748. Patches on PSIRTSUPT-26333.

Reporter: Nassim Abbaoui (OVHcloud). Verification: static analysis (PSIRTSUPT-26333).