Bug 2559580 (CVE-2026-115642) - CVE-2026-115642 keystonemiddleware: keystonemiddleware: application credential access_rules bypass via X-Service-Token header presence check
Summary: CVE-2026-115642 keystonemiddleware: keystonemiddleware: application credentia...
Keywords:
Status: NEW
Alias: CVE-2026-115642
Deadline: 2026-10-29
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-23 12:13 UTC by OSIDB Bzimport
Modified: 2026-10-29 17:39 UTC (History)
23 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-23 12:13:12 UTC 
keystonemiddleware provides the auth_token WSGI middleware used by all OpenStack services to validate Keystone tokens. Application credentials can carry access_rules that restrict which HTTP methods and API paths the bearer may call.

The vulnerability is in BaseAuthProtocol.validate_allowed_request() in keystonemiddleware/auth_token/__init__.py (lines 592-596). The guard uses request.service_token (raw X-Service-Token header presence) instead of request.service_token_valid (validated service token) to skip access_rules enforcement. A secondary instance at line 420-421 skips _confirm_token_bind() under the same mistaken header-presence check.

Upstream affected version ranges (embargo): < 10.12.2, >= 11.0.0 < 12.0.1, >= 13.0.0 < 13.0.2. Proposed fixes on master (2027.1) and stable branches 2026.2, 2026.1, 2025.2, 2025.1. Launchpad #2162748. Patches on PSIRTSUPT-26333.

Reporter: Nassim Abbaoui (OVHcloud). Verification: static analysis (PSIRTSUPT-26333).
Note You need to log in before you can comment on or make changes to this bug.