UNKNOWN OpenStack
CVE-2026-80182
OSSA-2026-037: Inconsistent scope enforcement for delegated tokens in Keystone
Grzegorz Grasza (Red Hat) reported that OpenStack Keystone did not consistently block delegated tokens from creating new long-lived credentials or authorizing new delegations. Tim Shephard (roiai.ca) separately reported that delegated tokens could be submitted to the token-method authentication path to escape their project scope. A token scoped through an OAuth1 access token, an application credential, or a trust could create new long-lived credentials or authorize new delegations that persist i
Affected Products
- Keystone: >=13.0.0 <27.0.3, >=28.0.0 <28.0.3, >=29.0.0 <29.0.3
- CVE-2026-80182
- CVE-2026-80184
References
- https://security.openstack.org/ossa/OSSA-2026-037.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-80182
- https://nvd.nist.gov/vuln/detail/CVE-2026-80184
This unknown severity vulnerability was published on 2026-08-25 via OpenStack. Affected: Keystone: >=13.0.0 <27.0.3, >=28.0.0 <28.0.3, >=29.0.0 <29.0.3, CVE-2026-80182, CVE-2026-80184.
vulnfeed aggregates 13827 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.