CVE-2026-90460

An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods EC2 credentials, application credentials, OAuth1 access tokens, and trusts are not blocked from creating, modifying, or deleting credentials via the /v3/credentials API. EC2-derived...