Executive brief
OpenStack Keystone is an identity and access control service used to manage authentication and authorization across cloud deployments. A policy evaluation flaw allows any authenticated user with a basic reader role on any project to view sensitive role assignment data across all domains in the cloud, including user names, IDs, and project information that should be restricted. This enables attackers to map the entire cloud structure and discover other domains for further exploitation.
Technical details
The vulnerability is an authorization bypass in the list_role_assignments_for_tree function caused by improper handling of None values in policy evaluation. When a domain ID is passed as scope.project.id to the GET /v3/role_assignments endpoint with include_subtree, the target.domain_id resolves to None, and oslo.policy stringifies this as "None". Project-scoped tokens also have domain_id=None, causing the policy check (role:reader AND domain_id:%(target.domain_id)s) to incorrectly match all project-scoped tokens regardless of domain membership. The flaw enables any authenticated user holding role:reader on any project to enumerate all role assignments across arbitrary domains. With include_names, responses disclose user names, group names, project names, role names, and their associated domain IDs, facilitating further reconnaissance. The vulnerability was introduced in OpenStack Train 16.0.0 and affects all versions before 29.0.3.
Affected products
- OpenStack Keystone Train 16.0.0 through 29.0.2
Timeline
- 2026-08-27: disclosed
- 2026-08-27: patched: Fixed in version 29.0.3