Executive brief
OpenStack Keystone is the authentication and authorization service used in OpenStack cloud deployments. This vulnerability allows tokens issued through delegated authentication mechanisms (such as application credentials, OAuth1 access tokens, or trusts) to escape their intended project scope boundaries when resubmitted for reauthentication. An attacker with a delegated token scoped to one project could obtain an unintended new token scoped to a different project, bypassing access controls and potentially accessing resources they should not have permission to use.
Technical details
The vulnerability exists in the token-method authentication path (POST /v3/auth/tokens) in Keystone versions before 27.0.3, 28.0.3, and 29.0.3. When a delegated token (application credential, OAuth1 access token, EC2 credential, or trust) is submitted for reauthentication without an explicit scope request, Keystone fails to maintain the original delegation boundary. Instead, it applies default-project scoping logic, which can reassign the token to the credential owner's default project if the owner has role assignments there. The vulnerability affects deployments with default settings (token.allow_rescope_scoped_token=True) and requires no special authentication or user interaction beyond possession of a delegated credential. Patches are available across all affected release series and must be applied in full, as the two interdependent patch sets address both delegation classification logic and reauthentication guards. After patching, administrators must verify custom authentication plugins are declared in the new [auth] additional_primary_auth_methods configuration option.
Affected products
- OpenStack Keystone >=13.0.0 <27.0.3, >=28.0.0 <28.0.3, >=29.0.0 <29.0.3
Timeline
- 2026-08-25: disclosed: OpenStack Security Advisory OSSA-2026-037 published
- 2026-08-25: patched: Patches available for all affected release series (2025.1/epoxy, 2025.2/flamingo, 2026.1/gazpacho, 2026.2/hibiscus)