OpenStack Keystone <29.0.3: Delegated Auth Token Scope Escalation
CVE-2026-80184 Published on August 25, 2026
In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms (OAuth1 access tokens, application credentials, trusts) could be submitted to the token-method authentication path for reauthentication to escape their intended project scope. When an application credential token was presented with no explicit scope, Keystone would issue a new token scoped to the credential owner's default project rather than the project for which the credential was issued, bypassing the intended project boundary. All Keystone deployments that permit delegated authentication through OAuth1 access tokens, application credentials, or trusts are affected.
Vulnerability Analysis
CVE-2026-80184 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. Public availability of a proof of concept (POC) exploit exists for CVE-2026-80184. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is an AuthZ Vulnerability?
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVE-2026-80184 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-80184
Want to know whenever a new CVE is published for OpenStack Keystone? stack.watch will email you.
Affected Versions
OpenStack Keystone:- Version 13.0.0 and below 27.0.3 is affected.
- Version 28.0.0 and below 28.0.3 is affected.
- Version 29.0.0 and below 29.0.3 is affected.