TI-2026-32344 Aliases CVE-2026-44394 GHSA-whqr-fgm5-x77q

Incorrect authorization in OpenStack Keystone

LOW 35CWE-863Published 2026-05-28 · Updated 2026-05-28

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: Partial Red Hat: 4 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-863.

Summary

An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone federated token rescoping mechanism does not propagate the original token's expiry to the newly issued token. When a federated user rescopes a token via POST /v3/auth/tokens, the handle_scoped_token() function in the mapped authentication plugin returns response data without an expires_at value. The token provider falls back to issuing a token with a fresh default TTL. By rescoping repeatedly before each token expires, a user can maintain access indefinitely, bypassing operator-configured token lifetime policies. This is a variant of CVE-2012-3426. Only deployments using federated identity (SAML2, OpenID Connect) are affected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00249 16th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Partial Keystone (OpenStack): 27.0.2, 28.0.2, 29.0.2keystone (PyPI): 27.0.2, 28.0.2, 29.0.2Red Hat: 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
OpenStack	Keystone	14.0.0 to before 27.0.2; 28.0.0 to before 28.0.2; 29.0.0 to before 29.0.2	27.0.2, 28.0.2, 29.0.2	Patch available	CNA
—	keystone (PyPI)	14.0.0 to before 27.0.2	27.0.2	Patch available	GHSA-whqr-fgm5-x77q
—	keystone (PyPI)	28.0.0 to before 28.0.2	28.0.2	Patch available	GHSA-whqr-fgm5-x77q
—	keystone (PyPI)	29.0.0 to before 29.0.2	29.0.2	Patch available	GHSA-whqr-fgm5-x77q

Keystone VendorOpenStack Affected 14.0.0 to before 27.0.2; 28.0.0 to before 28.0.2; 29.0.0 to before 29.0.2 Fixed in 27.0.2, 28.0.2, 29.0.2 Patch available CNA
keystone (PyPI) Vendor— Affected 14.0.0 to before 27.0.2 Fixed in 27.0.2 Patch available GHSA-whqr-fgm5-x77q
keystone (PyPI) Vendor— Affected 28.0.0 to before 28.0.2 Fixed in 28.0.2 Patch available GHSA-whqr-fgm5-x77q
keystone (PyPI) Vendor— Affected 29.0.0 to before 29.0.2 Fixed in 29.0.2 Patch available GHSA-whqr-fgm5-x77q

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:openstack:keystone::::::::	14.0.0 to before 27.0.2; 28.0.0 to before 28.0.2; 29.0.0 to before 29.0.2	Vulnerable	OpenStack

cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:* Versions 14.0.0 to before 27.0.2; 28.0.0 to before 28.0.2; 29.0.0 to before 29.0.2 Vulnerable ·OpenStack

Remediation

Fix · CNA Keystone (OpenStack) Fixed in 27.0.2, 28.0.2, 29.0.2
Fix · GHSA-whqr-fgm5-x77q keystone (PyPI) Fixed in 27.0.2 Advisory →
Fix · GHSA-whqr-fgm5-x77q keystone (PyPI) Fixed in 28.0.2 Advisory →
Fix · GHSA-whqr-fgm5-x77q keystone (PyPI) Fixed in 29.0.2 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-05-28
OpenStack Keystone 27.0.2, 28.0.2, 29.0.2
4 records Highest priority Priority LOW 4 LOW
Other records, highest priority first
- TI-2026-31180 Incorrect authorization in OpenStack KeystonePriority LOW 38
- TI-2026-31179 Incorrect authorization in OpenStack KeystonePriority LOW 38
- TI-2026-31178 Incorrect authorization in OpenStack KeystonePriority LOW 38
Show all 4 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat OpenStack Platform 13 (Queens)	Affected	No fix yet: Fix deferred
Red Hat OpenStack Platform 16.2	Affected	No fix yet: Fix deferred
Red Hat OpenStack Platform 17.1	Affected	No fix yet: Fix deferred
Red Hat OpenStack Platform 18.0	Affected	No fix yet: Fix deferred

Timeline

2026-10-02 Threatist record created from CVE-2026-44394
2026-10-03 Alias added: GHSA-whqr-fgm5-x77q

References

Other 2

TI-2026-25942 Incorrect authorization in OpenStack Keystone CVSS 3.1MEDIUM 5.3
TI-2020-10091 An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. CVSS 3.1HIGH 8.8
TI-2020-10090 An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. CVSS 3.1HIGH 8.8
TI-2019-14184 OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials… CVSS 3.1HIGH 8.8
TI-2020-10089 An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. CVSS 3.1HIGH 8.8
TI-2014-02273 The V3 API in OpenStack Identity (Keystone) 2013.1 before 2013.2.4 and icehouse before… CVSS 2.0HIGH 7.8

See all 43 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences