Is CVE-2026-44394 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44394 being exploited in the wild.

How severe is CVE-2026-44394?

Medium severity, with a CVSS score of 6, published 28 May 2026.

Which products and versions are affected?

keystone (PyPI) ECOSYSTEM:introduced=14.0.0,fixed=27.0.2, ECOSYSTEM:introduced=14.0.0,fixed=27.0.2,introduced=28.0.0,fixed=28.0.2,introduced=29.0.0,fixed=29.0.2.

Is there a fix for CVE-2026-44394?

Yes. keystone (PyPI): upgrade to 27.0.2, 29.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44394 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-44394?

Check whether you run keystone (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44394: OpenStack Keystone authentication expiry bypass in federated token rescoping

CVE-2026-44394 · Severity: medium · CVSS 6 · Published 2026-05-28

OpenStack Keystone, the identity service for OpenStack cloud environments, contains a flaw in how it handles login sessions for users authenticated via external identity providers (like SAML or OpenID Connect). When these users switch between different projects or roles, the system incorrectly resets their session timer instead of keeping the original expiration date. This allows a user to stay logged in indefinitely by repeatedly switching roles, potentially maintaining access to cloud resources even after their corporate account has been disabled or revoked.

Technologies: keystone (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-44394 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44394 being exploited in the wild.
How severe is CVE-2026-44394?: Medium severity, with a CVSS score of 6, published 28 May 2026.
Which products and versions are affected?: keystone (PyPI) ECOSYSTEM:introduced=14.0.0,fixed=27.0.2, ECOSYSTEM:introduced=14.0.0,fixed=27.0.2,introduced=28.0.0,fixed=28.0.2,introduced=29.0.0,fixed=29.0.2.
Is there a fix for CVE-2026-44394?: Yes. keystone (PyPI): upgrade to 27.0.2, 29.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44394 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-44394?: Check whether you run keystone (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

keystone (PyPI): upgrade to 27.0.2, 29.0.2 or later
```
pip install "keystone>=29.0.2"
```

Technical details

A vulnerability in OpenStack Keystone's federated authentication plugin allows for session lifetime extension. When a federated user (SAML2/OIDC) performs a token rescope via 'POST /v3/auth/tokens', the 'handle_scoped_token()' function in 'keystone/auth/plugins/mapped.py' fails to include the 'expires_at' attribute in the response data. Consequently, the token provider defaults to a fresh Time-To-Live (TTL) for the new token rather than inheriting the remaining lifespan of the original token. An authenticated attacker can exploit this by repeatedly rescoping their token before it expires to bypass operator-configured session limits and maintain access after upstream revocation. This issue is fixed in versions 27.0.2, 28.0.2, and 29.0.2.

Affected products

OpenStack Keystone >= 14.0.0, < 27.0.2; >= 28.0.0, < 28.0.2; >= 29.0.0, < 29.0.2

Identifiers

CVE-2026-44394
GHSA-whqr-fgm5-x77q
PYSEC-2026-603

Timeline

2026-04-26: disclosed: Bug reported to OpenStack Launchpad
2026-05-28: advisory: OSSA-2026-015 and GHSA published
2026-05-28: patched: Patched versions released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.