Bug 2532331 (CVE-2026-90460) - CVE-2026-90460 openstack-keystone: openstack-keystone: PATCH /v3/credentials accepts unauthorized post-update project_id; EC2-derived tokens bypass delegation scope check
Summary: CVE-2026-90460 openstack-keystone: openstack-keystone: PATCH /v3/credentials ...
Keywords:
Status: NEW
Alias: CVE-2026-90460
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-11 22:24 UTC by OSIDB Bzimport
Modified: 2026-10-08 13:01 UTC (History)
7 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-09-11 22:24:50 UTC 
An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods (EC2 credentials, application credentials, OAuth1 access tokens, and trusts) are not blocked from creating, modifying, or deleting credentials via the /v3/credentials API. EC2-derived tokens can additionally read credential blobs, exposing TOTP MFA seeds and other secrets. Also, PATCH /v3/credentials does not validate the requested post-update project_id, allowing any delegated token to move a credential to an unauthorized project. All Keystone deployments using delegated authentication are affected.
Note You need to log in before you can comment on or make changes to this bug.