Read the docs
TI-2026-31178 Aliases CVE-2026-42998GHSA-8f8m-wrvr-wcvf

Incorrect authorization in OpenStack Keystone

Priority LOW 38CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 4 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-863.

Summary

An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone application credential authentication plugin does not verify that the user supplied in the authentication request matches the owner of the application credential. An attacker can authenticate with their own application credential ID and secret while specifying a different user's name and domain in the request body. Keystone issues a token attributed to the victim user. The impersonated token is project-scoped and carries the intersection of the application credential's roles and the victim's actual roles on the project. This enables audit evasion, reading the victim's credentials, and acting as the victim within shared projects.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00303 23rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Keystone (OpenStack): 27.0.2, 28.0.2, 29.0.2keystone (PyPI): 27.0.2, 28.0.2, 29.0.2Red Hat: 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenStackKeystone14.0.0 to before 27.0.2; 28.0.0 to before 28.0.2; 29.0.0 to before 29.0.227.0.2, 28.0.2, 29.0.2Patch availableCNA
—keystone (PyPI)14.0.0 to before 27.0.227.0.2Patch availableGHSA-8f8m-wrvr-wcvf
—keystone (PyPI)28.0.0 to before 28.0.228.0.2Patch availableGHSA-8f8m-wrvr-wcvf
—keystone (PyPI)29.0.0 to before 29.0.229.0.2Patch availableGHSA-8f8m-wrvr-wcvf
  • Keystone VendorOpenStack Affected 14.0.0 to before 27.0.2; 28.0.0 to before 28.0.2; 29.0.0 to before 29.0.2 Fixed in 27.0.2, 28.0.2, 29.0.2 Patch available CNA
  • keystone (PyPI) Vendor— Affected 14.0.0 to before 27.0.2 Fixed in 27.0.2 Patch available GHSA-8f8m-wrvr-wcvf
  • keystone (PyPI) Vendor— Affected 28.0.0 to before 28.0.2 Fixed in 28.0.2 Patch available GHSA-8f8m-wrvr-wcvf
  • keystone (PyPI) Vendor— Affected 29.0.0 to before 29.0.2 Fixed in 29.0.2 Patch available GHSA-8f8m-wrvr-wcvf

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:*14.0.0 to before 27.0.2; 28.0.0 to before 28.0.2; 29.0.0 to before 29.0.2VulnerableOpenStack
  • cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:* Versions 14.0.0 to before 27.0.2; 28.0.0 to before 28.0.2; 29.0.0 to before 29.0.2 Vulnerable ·OpenStack

Remediation

  • Fix · CNA Keystone (OpenStack) Fixed in 27.0.2, 28.0.2, 29.0.2
  • Fix · GHSA-8f8m-wrvr-wcvf keystone (PyPI) Fixed in 27.0.2 Advisory →
  • Fix · GHSA-8f8m-wrvr-wcvf keystone (PyPI) Fixed in 28.0.2 Advisory →
  • Fix · GHSA-8f8m-wrvr-wcvf keystone (PyPI) Fixed in 29.0.2 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    OpenStack Keystone 27.0.2, 28.0.2, 29.0.2

    4 records Highest priority Priority LOW 4 LOW

    Other records, highest priority first

    • TI-2026-31180 Incorrect authorization in OpenStack KeystonePriority LOW 38
    • TI-2026-31179 Incorrect authorization in OpenStack KeystonePriority LOW 38
    • TI-2026-32344 Incorrect authorization in OpenStack KeystonePriority LOW 35
    Show all 4 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix yet: Fix deferred
Red Hat OpenStack Platform 16.2AffectedNo fix yet: Fix deferred
Red Hat OpenStack Platform 17.1AffectedNo fix yet: Fix deferred
Red Hat OpenStack Platform 18.0AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-42998
  2. 2026-10-03 Alias added: GHSA-8f8m-wrvr-wcvf

References

Exploit 1

Patch 1

Advisory 1

Other 2

  • TI-2026-25942 Incorrect authorization in OpenStack Keystone CVSS 3.1MEDIUM 5.3
  • TI-2020-10091 An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. CVSS 3.1HIGH 8.8
  • TI-2020-10090 An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. CVSS 3.1HIGH 8.8
  • TI-2019-14184 OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials… CVSS 3.1HIGH 8.8
  • TI-2020-10089 An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. CVSS 3.1HIGH 8.8
  • TI-2014-02273 The V3 API in OpenStack Identity (Keystone) 2013.1 before 2013.2.4 and icehouse before… CVSS 2.0HIGH 7.8
See all 43 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences