EUVD-2026-76758

An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods EC2 credentials, application credentials, OAuth1 access tokens, and trusts are not blocked from creating, modifying, or deleting credentials via the /v3/credentials API. EC2-derived...

EUVD-2026-76744

When a particular authentication mode is configured, the reverse proxy forwards requests for a bundled third-party administrative interface directly to that interface without applying the gateway's own authentication requirement first. All access control for this administrative interface, which...

Linux Distros Unpatched Vulnerability : CVE-2026-90460

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods EC2 credentials, application credentials, OAut...

DEBIAN-CVE-2026-90460

An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods EC2 credentials, application credentials, OAuth1 access tokens, and trusts are not blocked from creating, modifying, or deleting credentials via the /v3/credentials API. EC2-derived...

CVE-2026-90460

An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods EC2 credentials, application credentials, OAuth1 access tokens, and trusts are not blocked from creating, modifying, or deleting credentials via the /v3/credentials API. EC2-derived...

CVE-2026-90460

OpenStack Keystone before 29.0.3 has an authorization flaw in the /v3/credentials API . Tokens obtained via delegated authentication methods (EC2 credentials, application credentials, OAuth1 access tokens, and trusts) are not prevented from creating, modifying, or deleting credentials. EC2-derive...

CVE-2026-90460

An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods EC2 credentials, application credentials, OAuth1 access tokens, and trusts are not blocked from creating, modifying, or deleting credentials via the /v3/credentials API. EC2-derived...

CVE-2026-90460

An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods EC2 credentials, application credentials, OAuth1 access tokens, and trusts are not blocked from creating, modifying, or deleting credentials via the /v3/credentials API. EC2-derived...

PT-2026-90507

An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods EC2 credentials, application credentials, OAuth1 access tokens, and trusts are not blocked from creating, modifying, or deleting credentials via the /v3/credentials API. EC2-derived...

EUVD-2026-66121

In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms OAuth1 access tokens, application credentials, trusts could be submitted to the token-method authentication path for reauthentication to escape their intended project scope. When an application credential...

Linux Distros Unpatched Vulnerability : CVE-2026-80184

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms OAuth1 access tokens, application credentials, trusts could be...

DEBIAN-CVE-2026-80184

In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms OAuth1 access tokens, application credentials, trusts could be submitted to the token-method authentication path for reauthentication to escape their intended project scope. When an application credential...

CVE-2026-80184

In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms OAuth1 access tokens, application credentials, trusts could be submitted to the token-method authentication path for reauthentication to escape their intended project scope. When an application credential...

CVE-2026-80184

In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms OAuth1 access tokens, application credentials, trusts could be submitted to the token-method authentication path for reauthentication to escape their intended project scope. When an application credential...

UBUNTU-CVE-2026-80184

In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms OAuth1 access tokens, application credentials, trusts could be submitted to the token-method authentication path for reauthentication to escape their intended project scope. When an application credential...

CVE-2026-80184

In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms OAuth1 access tokens, application credentials, trusts could be submitted to the token-method authentication path for reauthentication to escape their intended project scope. When an application credential...

CVE-2026-80184

OpenStack Keystone versions before 29.0.3 are affected by a project-scope escape vulnerability in the token-method authentication path. Tokens obtained via delegated authentication mechanisms (OAuth1 access tokens, application credentials, or trusts) can be submitted for reauthentication and, whe...

CVE-2026-80184

In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms OAuth1 access tokens, application credentials, trusts could be submitted to the token-method authentication path for reauthentication to escape their intended project scope. When an application credential...

CVE-2026-80184

In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms OAuth1 access tokens, application credentials, trusts could be submitted to the token-method authentication path for reauthentication to escape their intended project scope. When an application credential...

PT-2026-81880

Name of the Vulnerable Software and Affected Versions OpenStack Keystone versions prior to 29.0.3 Description Tokens obtained through delegated authentication mechanisms, such as OAuth1 access tokens, application credentials, or trusts, can be submitted to the token-method authentication path for...