CVE-2026-90460
An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated...
An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods (EC2 credentials, application credentials, OAuth1 access tokens, and trusts) are not blocked from creating, modifying, or deleting credentials via the /v3/credentials API. EC2-derived tokens can additionally read credential blobs, exposing TOTP MFA seeds and other secrets. Also, PATCH /v3/credentials does not validate the requested post-update project_id, allowing any delegated token to move a credential to an unauthorized project. All Keystone deployments using delegated authentication are affected.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods (EC2 credentials, application credentials, OAuth1 access tokens, and trusts) are not blocked from creating, modifying, or deleting credentials via the /v3/credentials API. EC2-derived tokens can additionally read credential blobs, exposing TOTP MFA seeds and other secrets. Also, PATCH /v3/credentials does not validate the requested post-update project_id, allowing any delegated token to move a credential to an unauthorized project. All Keystone deployments using delegated authentication are affected.
- Record
CVE-2026-90460- CVSS 4.0
- 7.6 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-863
- Updated
- 2026-11-02
EUVDEUVD-2026-76758
An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods (EC2 credentials, application credentials, OAuth1 access tokens, and trusts) are not blocked from creating, modifying, or deleting credentials via the /v3/credentials API. EC2-derived tokens can additionally read credential blobs, exposing TOTP MFA seeds and other secrets. Also, PATCH /v3/credentials does not validate the requested post-update project_id, allowing any delegated token to move a credential to an unauthorized project. All Keystone deployments using delegated authentication are affected.
- Record
EUVD-2026-76758- CVSS 4.0
- 7.6 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-qfjc-4hpf-mgw2
An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated...
An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods (EC2 credentials, application credentials, OAuth1 access tokens, and trusts) are not blocked from creating, modifying, or deleting credentials via the /v3/credentials API. EC2-derived tokens can additionally read credential blobs, exposing TOTP MFA seeds and other secrets. Also, PATCH /v3/credentials does not validate the requested post-update project_id, allowing any delegated token to move a credential to an unauthorized project. All Keystone deployments using delegated authentication are affected.
- Record
GHSA-qfjc-4hpf-mgw2- CVSS 4.0
- 7.6 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-863
- Updated
- 2026-11-02
NVD
An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods (EC2 credentials, application credentials, OAuth1 access tokens, and trusts) are not blocked from creating, modifying, or deleting credentials via the /v3/credentials API. EC2-derived tokens can additionally read credential blobs, exposing TOTP MFA seeds and other secrets. Also, PATCH /v3/credentials does not validate the requested post-update project_id, allowing any delegated token to move a credential to an unauthorized project. All Keystone deployments using delegated authentication are affected.
- Record
CVE-2026-90460- CVSS 4.0
- 7.6 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-863
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-90460
An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods (EC2 credentials, application credentials, OAuth1 access tokens, and trusts) are not blocked from creating, modifying, or deleting credentials via the /v3/credentials API. EC2-derived tokens can additionally read credential blobs, exposing TOTP MFA seeds and other secrets. Also, PATCH /v3/credentials does not validate the requested post-update project_id, allowing any delegated token to move a credential to an unauthorized project. All Keystone deployments using delegated authentication are affected.
- Record
DEBIAN-CVE-2026-90460- CVSS 4.0
- 7.6 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-90460
An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods (EC2 credentials, application credentials, OAuth1 access tokens, and trusts) are not blocked from creating, modifying, or deleting credentials via the /v3/credentials API. EC2-derived tokens can additionally read credential blobs, exposing TOTP MFA seeds and other secrets. Also, PATCH /v3/credentials does not validate the requested post-update project_id, allowing any delegated token to move a credential to an unauthorized project. All Keystone deployments using delegated authentication are affected.
- Record
UBUNTU-CVE-2026-90460- CVSS 4.0
- 7.6 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
keystoneDebian:12 |
before 2:22.0.2-0+deb12u5, plus listed versions 2:22.0.0-22:22.0.2-0+deb12u12:22.0.2-0+deb12u22:22.0.2-0+deb12u32:22.0.2-0+deb12u4 |
2:22.0.2-0+deb12u5 |
keystoneDebian:13 |
before 2:27.0.0-3+deb13u6, plus listed versions 2:27.0.0-32:27.0.0-3+deb13u12:27.0.0-3+deb13u32:27.0.0-3+deb13u42:27.0.0-3+deb13u5 |
2:27.0.0-3+deb13u6 |
keystoneDebian:14 |
before 2:30.0.0~rc1-1, plus listed versions 2:27.0.0-32:28.0.0-12:28.0.0-22:28.0.0-32:28.0.0-4 Show 15 moreShow less2:28.0.0-52:28.0.0-62:28.0.0~rc1-12:28.0.0~rc1-22:28.0.0~rc1-42:29.0.0-12:29.0.0-22:29.0.0-32:29.0.0~rc1-12:29.0.0~rc1-22:29.0.1-12:29.0.1-22:29.0.2-12:29.0.2-22:29.1.0-1 |
2:30.0.0~rc1-1 |
keystoneUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2:8.0.0-0ubuntu12:9.0.0~b1-0ubuntu12:9.0.0~b2-0ubuntu12:9.0.0~b3-0ubuntu12:9.0.0~rc1-0ubuntu1 Show 11 moreShow less2:9.0.0-0ubuntu12:9.0.2-0ubuntu12:9.0.2-0ubuntu22:9.1.0-0ubuntu12:9.2.0-0ubuntu12:9.3.0-0ubuntu12:9.3.0-0ubuntu22:9.3.0-0ubuntu32:9.3.0-0ubuntu3.12:9.3.0-0ubuntu3.22:9.3.0-0ubuntu3.2+esm2 |
None known |
keystoneUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2:12.0.0-0ubuntu12:13.0.0~b1-0ubuntu12:13.0.0~b2-0ubuntu12:13.0.0~b3-0ubuntu12:13.0.0~rc1-0ubuntu1 Show 7 moreShow less2:13.0.0~rc2-0ubuntu12:13.0.0-0ubuntu12:13.0.1-0ubuntu12:13.0.2-0ubuntu12:13.0.2-0ubuntu32:13.0.4-0ubuntu12:13.0.4-0ubuntu1+esm1 |
None known |
keystoneUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2:16.0.0-0ubuntu12:17.0.0~b1~git2019121613.db81fee63-0ubuntu12:17.0.0~b2~git2020020513.99733f172-0ubuntu12:17.0.0~b3~git2020032415.9f9040257-0ubuntu12:17.0.0~b3~git2020032415.9f9040257-0ubuntu2 Show 6 moreShow less2:17.0.0~b3~git2020041013.7bb6314e4-0ubuntu12:17.0.0-0ubuntu0.20.04.12:17.0.1-0ubuntu12:17.0.1-0ubuntu22:17.0.1-0ubuntu2+esm12:17.0.1-0ubuntu2+esm2 |
None known |
keystoneUbuntu:22.04:LTS |
All versions, plus listed versions 2:20.0.0-0ubuntu12:20.0.0+git2021120815.2ddf8f321-0ubuntu12:20.0.0+git2022011217.771c943ad-0ubuntu12:20.0.0+git2022030313.a3fc9e7c3-0ubuntu12:21.0.0-0ubuntu1 Show 6 moreShow less2:21.0.1-0ubuntu12:21.0.1-0ubuntu22:21.0.1-0ubuntu2.12:21.0.1-0ubuntu2.22:21.0.1-0ubuntu2.42:21.0.1-0ubuntu2.6 |
None known |
keystoneUbuntu:24.04:LTS |
All versions, plus listed versions 2:24.0.0-0ubuntu12:24.0.0+git2024011916.adfa92b4-0ubuntu12:25.0.0~rc1-0ubuntu12:25.0.0-0ubuntu12:25.0.0-0ubuntu1.12:25.0.0-0ubuntu1.22:25.0.0-0ubuntu1.42:25.0.0-0ubuntu1.6 |
None known |
keystoneUbuntu:26.10 |
All versions, plus listed versions 2:29.0.0-0ubuntu12:29.0.0-0ubuntu22:29.0.0+git20260805.67.16afc81-0ubuntu12:30.0.0~rc1-0ubuntu12:30.0.0-0ubuntu1 |
None known |
keystoneUbuntu:26.04:LTS |
All versions, plus listed versions 2:28.0.0-0ubuntu12:28.0.0-0ubuntu22:28.0.0+git20260119.61.8a42793e7-0ubuntu12:29.0.0~rc1-0ubuntu12:29.0.0-0ubuntu12:29.0.0-0ubuntu1.22:29.0.0-0ubuntu1.4 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-90460 is a high vulnerability (CVSS 7.6) in Openstack Keystone, published September 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.57%, the 47th percentile. Fixed in keystone 2:22.0.2-0+deb12u5.