As per upstream announce at:
https://security.openstack.org/ossa/OSSA-2026-037.html


Date: August 25, 2026

CVE: CVE-2026-80182, CVE-2026-80184

Affects: Keystone: >=13.0.0 <27.0.3, >=28.0.0 <28.0.3, >=29.0.0 <29.0.3

Description:
Grzegorz Grasza (Red Hat) reported that OpenStack Keystone did not consistently
block delegated tokens from creating new long-lived credentials or authorizing
new delegations. Tim Shephard (roiai.ca) separately reported that delegated
tokens could be submitted to the token-method authentication path to escape
their project scope.

A token scoped through an OAuth1 access token, an application credential, or a
trust could create new long-lived credentials or authorize new delegations
that persist independently of, and outlive, the credential used to obtain
them. Separately, tokens obtained through any of these delegation mechanisms
could be submitted to the token-method authentication path for
reauthentication. When an application credential token was presented with no
explicit scope, Keystone would issue a new token scoped to the credential
owner’s default project rather than the project for which the credential was
issued, escaping the intended project boundary.

All Keystone deployments that permit delegated authentication through OAuth1
access tokens, application credentials, or trusts are affected.

Errata:
CVE-2026-80182 and CVE-2026-80184 have been assigned for these vulnerabilities.

Patches:
https://review.opendev.org/1002307 (2025.1/epoxy)
https://review.opendev.org/1002308 (2025.1/epoxy)
https://review.opendev.org/1002305 (2025.2/flamingo)
https://review.opendev.org/1002306 (2025.2/flamingo)
https://review.opendev.org/1002303 (2026.1/gazpacho)
https://review.opendev.org/1002304 (2026.1/gazpacho)
https://review.opendev.org/1002301 (2026.2/hibiscus (development))
https://review.opendev.org/1002302 (2026.2/hibiscus (development))

Credits:

    Grzegorz Grasza from Red Hat (CVE-2026-80182)
    Tim Shephard from roiai.ca (CVE-2026-80184)

References:
https://launchpad.net/bugs/2153453
https://launchpad.net/bugs/2158538
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80182
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80184

Notes:
    The two patch sets are interdependent and must be applied together. The
token reauthentication guard introduced by the second patch depends on the
delegation classification logic and the new [auth]
additional_primary_auth_methods configuration option introduced by the first.
Packaging or applying a subset is not supported.
    After upgrading, Keystone treats any authentication method not built in
to Keystone as a delegated credential and rejects it from guarded operations
(managing trusts, application credentials, and OAuth1 access tokens, and
token reauthentication). Deployments running a custom or third-party
authentication plugin must add it to [auth] additional_primary_auth_methods
or those authentication flows will fail.
    This advisory does not address a related weakness in EC2 credential
(ec2credential) handling, which is being tracked and fixed in public and
will be covered by a separate OpenStack Security Note (OSSN).
    A related fix to the Keystone Tempest plugin test suite was proposed
at https://review.opendev.org/1002296

OSSA History
    2026-08-25 - Errata 1
    2026-08-25 - Original Version

Hello,

Bug #1145669 in keystone reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/openstack-team/services/keystone/-/commit/9070c3738675cd448170bbbafc97cfd66814145e
------------------------------------------------------------------------
* Removed patches applied upstream:
    - 0001-Add-tests-for-restricted-app-cred-guard.patch
    - 0002-Block-restricted-app-creds-from-creating-EC2-credent.patch
    - 0003-Block-app-credential-token-rescoping.patch
    - 0004-Include-system-scope-in-rescope-guard.patch
    - 0005-Enforce-app-cred-project-boundary-on-EC2-credential-.patch
    - 0006-Block-app-cred-tokens-from-authorizing-OAuth1-reques.patch
    - CVE-2026-43001_1_Enforce_delegation_project_boundary_for_delegat....patch
    - CVE-2026-43001_2_Fix_user_impersonation_through_application_cred....patch
    - CVE-2026-43001_3_Forbid_trust_operations_using_application_crede....patch
    - CVE-2026-43001_4_Preserve_expires_at_when_rescoping_federated_to....patch
    - CVE-2026-43001_5_Prevent_RBAC_policy_bypass_via_JSON_body_and_qu....patch
  * Add new patches (Closes: #1145669):
    - CVE-2026-80182_CVE-2026-80184_1_Ban_ec2credential_tokens_from_Ke....patch
    - CVE-2026-80182_CVE-2026-80184_2_trusts_oauth1_app-creds_reject_d....patch
    - CVE-2026-80182_CVE-2026-80184_3_lp-2158538-2026.1.patch
    - CVE-2026-80182_CVE-2026-80184_4_auth_encode_ec2credential_and_oa....patch
    - CVE-2026-80182_CVE-2026-80184_5_fix-unit-test.patch
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1145669

Hello,

Bug #1145669 in keystone reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/openstack-team/services/keystone/-/commit/f4d21c9b5f0c740b9b62fedd8551011054917911
------------------------------------------------------------------------
* Removed patches applied upstream:
    - 0001-Add-tests-for-restricted-app-cred-guard.patch
    - 0002-Block-restricted-app-creds-from-creating-EC2-credent.patch
    - 0003-Block-app-credential-token-rescoping.patch
    - 0004-Include-system-scope-in-rescope-guard.patch
    - 0005-Enforce-app-cred-project-boundary-on-EC2-credential-.patch
    - 0006-Block-app-cred-tokens-from-authorizing-OAuth1-reques.patch
    - CVE-2026-43001_1_Enforce_delegation_project_boundary_for_delegat....patch
    - CVE-2026-43001_2_Fix_user_impersonation_through_application_cred....patch
    - CVE-2026-43001_3_Forbid_trust_operations_using_application_crede....patch
    - CVE-2026-43001_4_Preserve_expires_at_when_rescoping_federated_to....patch
    - CVE-2026-43001_5_Prevent_RBAC_policy_bypass_via_JSON_body_and_qu....patch
  * Add new patches (Closes: #1145669):
    - CVE-2026-80182_CVE-2026-80184_1_Ban_ec2credential_tokens_from_Ke....patch
    - CVE-2026-80182_CVE-2026-80184_2_trusts_oauth1_app-creds_reject_d....patch
    - CVE-2026-80182_CVE-2026-80184_3_lp-2158538-2026.1.patch
    - CVE-2026-80182_CVE-2026-80184_4_auth_encode_ec2credential_and_oa....patch
    - CVE-2026-80182_CVE-2026-80184_5_fix-unit-test.patch
  * Really do not run this (non-deterministic) test:
    - test_bootstrap_is_not_idempotent_when_password_does_change
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1145669

We believe that the bug you reported is fixed in the latest version of
keystone, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1145669@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Thomas Goirand <zigo@debian.org> (supplier of updated keystone package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 25 Aug 2026 16:10:20 +0200
Source: keystone
Architecture: source
Version: 2:29.0.2-1
Distribution: unstable
Urgency: medium
Maintainer: Debian OpenStack <team+openstack@tracker.debian.org>
Changed-By: Thomas Goirand <zigo@debian.org>
Closes: 1145669
Changes:
 keystone (2:29.0.2-1) unstable; urgency=medium
 .
   * New upstream point release.
   * Removed patches applied upstream:
     - 0001-Add-tests-for-restricted-app-cred-guard.patch
     - 0002-Block-restricted-app-creds-from-creating-EC2-credent.patch
     - 0003-Block-app-credential-token-rescoping.patch
     - 0004-Include-system-scope-in-rescope-guard.patch
     - 0005-Enforce-app-cred-project-boundary-on-EC2-credential-.patch
     - 0006-Block-app-cred-tokens-from-authorizing-OAuth1-reques.patch
     - CVE-2026-43001_1_Enforce_delegation_project_boundary_for_delegat....patch
     - CVE-2026-43001_2_Fix_user_impersonation_through_application_cred....patch
     - CVE-2026-43001_3_Forbid_trust_operations_using_application_crede....patch
     - CVE-2026-43001_4_Preserve_expires_at_when_rescoping_federated_to....patch
     - CVE-2026-43001_5_Prevent_RBAC_policy_bypass_via_JSON_body_and_qu....patch
   * Add new patches (Closes: #1145669):
     - CVE-2026-80182_CVE-2026-80184_1_Ban_ec2credential_tokens_from_Ke....patch
     - CVE-2026-80182_CVE-2026-80184_2_trusts_oauth1_app-creds_reject_d....patch
     - CVE-2026-80182_CVE-2026-80184_3_lp-2158538-2026.1.patch
     - CVE-2026-80182_CVE-2026-80184_4_auth_encode_ec2credential_and_oa....patch
     - CVE-2026-80182_CVE-2026-80184_5_fix-unit-test.patch
   * Really do not run this (non-deterministic) test:
     - test_bootstrap_is_not_idempotent_when_password_does_change
Checksums-Sha1:
 436016f6d1c800060d7c798cdf746c72efd994d7 3458 keystone_29.0.2-1.dsc
 e63747b15e2a0051e1d8fda748d21a98ba7f7e42 1130748 keystone_29.0.2.orig.tar.xz
 376d634617b95aae29aa206c5293bdd52334094e 62644 keystone_29.0.2-1.debian.tar.xz
 22590e16a130d44d7a5585b480c0a46382002ec4 17306 keystone_29.0.2-1_amd64.buildinfo
Checksums-Sha256:
 f2324b1418b175d80fc09a8ab6f0de41331d06c464dac77cc3fdb3b59cdc413b 3458 keystone_29.0.2-1.dsc
 dbdf2cd0f94353c0232299e305f0b40fae443e5540160fc65b8d23c2befd9b13 1130748 keystone_29.0.2.orig.tar.xz
 f731e1a701c2b440a30bf677f7e369eb06c33f69385553112de5256258e01a69 62644 keystone_29.0.2-1.debian.tar.xz
 35919c447c02946024b0a94b3480bb071fc7c4389b791ee1e619d7b8425b4483 17306 keystone_29.0.2-1_amd64.buildinfo
Files:
 690ec27828bda59505182d3eaa56d2a7 3458 net optional keystone_29.0.2-1.dsc
 8bc9d92e8aaf629ba07c68eb6d810beb 1130748 net optional keystone_29.0.2.orig.tar.xz
 816eda02266d8a0c9872037b5cd84d69 62644 net optional keystone_29.0.2-1.debian.tar.xz
 94017282d4071501254f5075f41fa5aa 17306 net optional keystone_29.0.2-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmqP+iUACgkQ1BatFaxr
Q/6fgg//QlyfqpGEJrEz7ME4iev0kyyNMxF8ndQBtwQ4N6ANOCvKxUKTp2UrS8/m
MLPqXYFTW6yobVzkfMoS4PWoWzfQGTMq86iqq0LdehM7f3C4p35kv9GfwX2H9yQY
2fG7AWC+KJOHBbY72PEbV+a6+opu21L/obcXjS4VWAcu52t7zLK8vnBWZ4+gKEsD
SBf63YIALT2pSXmccdpvfJMQI3UfVcYaD7sIa1Fo4uei3cfnq+F8+NI9yZGxBKXq
x6uSiTFmHc5TchmBdRqa7+ykexZSE6t5TS4QQtHWiYg1nY3bXbqWnKv6Ykvs9WhP
v9Inu0i2l+1TCuYJywSwZp+J4PfyolxaZpt6tLSpSlh0CR8r9vxyOdEd+CicWdRt
io5nCw6NWGG/nWunbbf7c8KiU8eGYnkTyYKNOb+r14F59nL4fyyiD6d5lMMz4elN
kFv/tdUQfTO/p9RA9qGQl9mTpGZI+I9z2JDCS/q9S65c7M2MmwZM0Jpf5+ax3UlT
250Np0rqzsLik7CJPPxeiKirwPkolr9qzAQi4eIV5f66pfUUp0J0ZXLOj28BZ5Ib
7pzE4Cho3fGk7bG0oPWEb4Pjse7W21Jw6dpDGfd7lPGqAqchAHEm/Q9XeBhHj+0G
/WDecMO4tgMmT4zzRfNh7Sonvpk9KzLDbspnv22JUY2KFyMxu40=
=CNSS
-----END PGP SIGNATURE-----

We believe that the bug you reported is fixed in the latest version of
keystone, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1145669@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Thomas Goirand <zigo@debian.org> (supplier of updated keystone package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Fri, 28 Aug 2026 09:41:35 +0200
Source: keystone
Architecture: source
Version: 2:27.0.0-3+deb13u5
Distribution: trixie-security
Urgency: medium
Maintainer: Debian OpenStack <team+openstack@tracker.debian.org>
Changed-By: Thomas Goirand <zigo@debian.org>
Closes: 1145669 1145816
Changes:
 keystone (2:27.0.0-3+deb13u5) trixie-security; urgency=medium
 .
   * CVE-2026-80184: Delegation bypass in trust, OAuth1, and application
     credential operations.
   * CVE-2026-80182: Tokens obtained via application credential or EC2
     credential authentication can escape their intended project scope through
     token-method reauthentication. An application-credential token scoped to
     one project can be exchanged via POST /v3/auth/tokens with no explicit
     scope, causing Keystone to issue a new token scoped to the owner's default
     project. For EC2-derived tokens the bypass is broader: because they carry
     no delegation markers, they can rescope to any project where the underlying
     user has role assignments.
   * Add new patches (Closes: #1145669):
     - CVE-2026-80182_CVE-2026-80184_1_Block_app_credential_token_resco....patch
     - CVE-2026-80182_CVE-2026-80184_2_auth_encode_ec2credential_and_oa....patch
     - CVE-2026-80182_CVE-2026-80184_3_trusts_oauth1_app-creds_reject_d....patch
     - CVE-2026-80182_CVE-2026-80184_4_auth_reject_delegated_tokens_fro....patch
   * CVE-2026-80183 / OSSN-2026-0XXX: any authenticated user holding role:reader
     on any project can list every project-scoped role assignment under any
     domain by passing a domain ID as scope.project.id with include_subtree to
     the GET /v3/role_assignments endpoint. The domain's project record has
     domain_id=null, causing the policy domain_id check to pass for any caller.
     With include_names, the response discloses the names and home-domain IDs of
     every user, group, project, and role involved. The literal "default" domain
     ID works against any deployment created with keystone-manage bootstrap. An
     attacker can harvest domain IDs from the response and repeat the query to
     map role assignments across the entire cloud. This is caused by misuse of
     "None" in list_role_assignments_for_tree.
     Applied upstream patch (Closes: #1145816):
     - CVE-2026-80183_Prevent_unauthorized_project-scoped_assignment_list.patch
Checksums-Sha1:
 8b7fa7356687caf2018cc031b84437f216098b6f 3486 keystone_27.0.0-3+deb13u5.dsc
 896a6f57c727fa62d0aec10d5c8844b40cc42bdb 1098444 keystone_27.0.0.orig.tar.xz
 590937c413889aa118ec5e2dfa3d39a54af4ced6 81732 keystone_27.0.0-3+deb13u5.debian.tar.xz
 d0acf734afd9fa9f74da92a47f411fd59c9bae47 18779 keystone_27.0.0-3+deb13u5_amd64.buildinfo
Checksums-Sha256:
 597252e68249fbbe1266d0778c459408508b432f4e4d9bb33f33c3ac690c81a7 3486 keystone_27.0.0-3+deb13u5.dsc
 223b27dc676dabd6c9d67e4409fe086f92b5d47bf71ee8c724c3e0d13f26d635 1098444 keystone_27.0.0.orig.tar.xz
 b80c4e12d419b1cd19b7fbf31fc615854bf8dee95001bb59fa5c4e9a189b2656 81732 keystone_27.0.0-3+deb13u5.debian.tar.xz
 3f48302bfafa73455f8cc84e85ca1120fc8a90a79d1f7e3cc23d48ece90aea89 18779 keystone_27.0.0-3+deb13u5_amd64.buildinfo
Files:
 df7fd282803d1e8db8bed179433a4772 3486 net optional keystone_27.0.0-3+deb13u5.dsc
 d8119041a4ba1c4545ab5dabe9ae65b9 1098444 net optional keystone_27.0.0.orig.tar.xz
 abaf99efbe87784c9ab911f75ccb2e42 81732 net optional keystone_27.0.0-3+deb13u5.debian.tar.xz
 e83a67b6056bcc9fa8be77219176f2cc 18779 net optional keystone_27.0.0-3+deb13u5_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmqVMGAACgkQ1BatFaxr
Q/5Lfw//ekgssRChl7JfyUUhn5+CnrmSfYuGlYu+Yrl0KtSGo89HmXaS3Lq0u/Nx
ild5Ulxdj6A23HsW8s3huMafD+a93sUWogLDEDLPWwRo6gXtNo00kpr//DaOir2N
lcEU/ryPdTusHSTJfuhEGjF6g1BuBVz8KDrd8M3gfgosilqXG676Vo6BfIAsn5OP
bo8lt9xQRHC72dtgZkQB7C7ZzLFuyG8gm8+FO6wwqg+NCkLHe3RwVZ+9MawBi0tA
65lb8Atf/UXVrjfM/3dO7mYdKzxPsDHNHnUjdq7Q2dnupx4/WoRc6Vx2ZxJB5ZTC
3pn84FZx5bB7O2b1Ka0F2DmDmyqoIuFKSWDfpgls5mvS1GfG+YAeZrG1g1/H/7s7
Xv+xbRM1RV4wjMj61Hhbdt/fErsvHrJVa2u7vtYjc1o59F4+oL4NAg8zbiGdJ4Rf
W9iCNyS9tHlxnPbe/IvTAKDYQrIYY7J7s+ZBvUKkWzdz6gO37ihHJteIXIrSTCX6
aTrVFrSvm1o4kBPltClgslrgPm+1TxWn1J1b0QJyWyI3b+hDwBlN/SDo0vTk68hR
E9ZDXkqZ/4/hmx0BhAEwM9aut2BCZvejVVif8u8Ww1dOe5ItS9B0zmCjgfMV3Axl
iQ/R3gH+74ySnLu27hSX2TZkVqbYFSmjNdgUHvwh0w3c/v1zSco=
=Z+0F
-----END PGP SIGNATURE-----