Description
An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods (EC2 credentials, application credentials, OAuth1 access tokens, and trusts) are not blocked from creating, modifying, or deleting credentials via the /v3/credentials API. EC2-derived tokens can additionally read credential blobs, exposing TOTP MFA seeds and other secrets. Also, PATCH /v3/credentials does not validate the requested post-update project_id, allowing any delegated token to move a credential to an unauthorized project. All Keystone deployments using delegated authentication are affected.
Published: 2026-09-11
Score: 7.6 High
EPSS: < 1% Very Low
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 15 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
Title OpenStack Keystone Delegated Authentication Tokens Allow Unauthorized Credential Management

Tue, 15 Sep 2026 06:45:00 +0000

Type Values Removed Values Added
Title Delegated Authentication Tokens Allow Unauthorized Credential Manipulation in OpenStack Keystone

Mon, 14 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 14 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Title Delegated Authentication Tokens Allow Unauthorized Credential Manipulation in OpenStack Keystone

Mon, 14 Sep 2026 03:00:00 +0000

Type Values Removed Values Added
Title Unrestricted Credential Manipulation via Delegated Tokens in Keystone

Sun, 13 Sep 2026 16:45:00 +0000

Type Values Removed Values Added
Title Unrestricted Credential Manipulation via Delegated Tokens in Keystone

Sun, 13 Sep 2026 08:30:00 +0000

Type Values Removed Values Added
Title Delegated Authentication Credential API Abuse in OpenStack Keystone

Sat, 12 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
Title Delegated Authentication Credential API Abuse in OpenStack Keystone

Sat, 12 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Title Credential API Bypass via Delegated Authentication Tokens in OpenStack Keystone

Sat, 12 Sep 2026 09:00:00 +0000

Type Values Removed Values Added
Title Credential API Bypass via Delegated Authentication Tokens in OpenStack Keystone

Fri, 11 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
Description An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods (EC2 credentials, application credentials, OAuth1 access tokens, and trusts) are not blocked from creating, modifying, or deleting credentials via the /v3/credentials API. EC2-derived tokens can additionally read credential blobs, exposing TOTP MFA seeds and other secrets. Also, PATCH /v3/credentials does not validate the requested post-update project_id, allowing any delegated token to move a credential to an unauthorized project. All Keystone deployments using delegated authentication are affected.
First Time appeared Openstack
Openstack keystone
Weaknesses CWE-863
CPEs cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:*
Vendors & Products Openstack
Openstack keystone
References
Metrics cvssV4_0

{'score': 7.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Openstack Keystone
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-09-14T16:21:40.794Z

Reserved: 2026-09-11T21:22:35.381Z

Link: CVE-2026-90460

cve-icon Vulnrichment

Updated: 2026-09-14T16:13:28.438Z

cve-icon NVD

Status : Received

Published: 2026-09-11T22:16:48.243

Modified: 2026-09-14T17:17:53.920

Link: CVE-2026-90460

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-15T20:45:20Z

Weaknesses