Executive brief
OpenStack Keystone is the identity and authentication service used to manage access across OpenStack cloud deployments. A flaw in how Keystone enforces scope restrictions on delegated tokens (those created via OAuth1, application credentials, or trusts) allows attackers with a stolen credential to create new long-lived credentials that persist independently and survive credential revocation, giving them persistent backdoor access that defeats emergency access revocation.
Technical details
The vulnerability is a logic error in delegated token scope enforcement. Keystone failed to consistently apply delegation restrictions across all token types: specifically, checks for restricting long-lived credential creation (application credentials, EC2 keys) only fired for certain token.methods values (e.g., 'application_credential', 'trust') but not others (e.g., 'ec2credential'). Additionally, delegated tokens could be resubmitted to the token-method authentication path, allowing scope escape (e.g., application-credential-scoped tokens defaulting to the credential owner's default project rather than the intended scope). An attacker with a stolen OAuth1 access token, application credential, or EC2 key pair can call endpoints like POST /v3/users/{id}/application_credentials to create new long-lived credentials that outlive the original token's revocation. Patches are available for Keystone versions 27.0.3, 28.0.3, and 29.0.3 and later.
Affected products
- OpenStack Keystone >=13.0.0 <27.0.3, >=28.0.0 <28.0.3, >=29.0.0 <29.0.3
Timeline
- 2026-05-20: disclosed: Bug reported by Grzegorz Grasza (Red Hat)
- 2026-08-25: advisory: OSSA-2026-037 published; CVE-2026-80182 and CVE-2026-80184 assigned
- 2026-08-25: patched: Patches available for multiple release branches