OpenStack Keystone <29.0.3: Delegated Auth Token Scope Escalation
CVE-2026-80184 Published on August 25, 2026
In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms (OAuth1 access tokens, application credentials, trusts) could be submitted to the token-method authentication path for reauthentication to escape their intended project scope. When an application credential token was presented with no explicit scope, Keystone would issue a new token scoped to the credential owner's default project rather than the project for which the credential was issued, bypassing the intended project boundary. All Keystone deployments that permit delegated authentication through OAuth1 access tokens, application credentials, or trusts are affected.
Vulnerability Analysis
CVE-2026-80184 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. Public availability of a proof of concept (POC) exploit exists for CVE-2026-80184. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is an AuthZ Vulnerability?
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVE-2026-80184 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-80184
stack.watch emails you whenever new vulnerabilities are published in OpenStack Keystone or Canonical Ubuntu Linux. Just hit a watch button to start following.
