Fabre

#1149956 keystone: CVE-2026-90460 #1149956

Package:: src:keystone

Source:: src:keystone

Submitter:: Salvatore Bonaccorso

Date:: 2026-10-17 14:34:42 UTC

Severity:: normal

Tags:

#1149956#5

Date:: 2026-10-04 19:00:49 UTC

From:

To:

Hi,

The following vulnerability was published for keystone.

CVE-2026-90460[0]:
| An issue was discovered in OpenStack Keystone before 29.0.3. Tokens
| obtained via delegated authentication methods (EC2 credentials,
| application credentials, OAuth1 access tokens, and trusts) are not
| blocked from creating, modifying, or deleting credentials via the
| /v3/credentials API. EC2-derived tokens can additionally read
| credential blobs, exposing TOTP MFA seeds and other secrets. Also,
| PATCH /v3/credentials does not validate the requested post-update
| project_id, allowing any delegated token to move a credential to an
| unauthorized project. All Keystone deployments using delegated
| authentication are affected.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-90460
https://www.cve.org/CVERecord?id=CVE-2026-90460
[1] https://bugs.launchpad.net/keystone/+bug/2159643
[2] https://bugs.launchpad.net/keystone/+bug/2158931
[3] https://review.opendev.org/c/openstack/keystone/+/1002330

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

#1149956#8

Date:: 2026-10-06 17:43:04 UTC

From:

To:

Hello,

Bug #1149956 in keystone reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/openstack-team/services/keystone/-/commit/112b6899466c6561aa84fc38a5d10944885cf1db
------------------------------------------------------------------------
* CVE-2026-90460: Delegated tokens (like ec2credential,
    application_credential, ...) can GET/PATCH/DELETE any credential including
    TOTP seeds. Delegation project boundary not enforced on PATCH
    /v3/credentials/{id}. This was due to an incomplete fix for OSSA-2026-015.
    Applied upstream patch: "credentials: reject delegated tokens, restrict
    PATCH to blob only" (Closes: #1149303, #1149956):
    - CVE-2026-90460_lp-2159643_credentials_reject_delegated-tokens_re....patch
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1149956

#1149956#13

Date:: 2026-10-06 17:44:11 UTC

From:

To:

Hello,

Bug #1149956 in keystone reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/openstack-team/services/keystone/-/commit/7ac5b82d27fd45cf7a7f37dfccb8f27176c207f2
------------------------------------------------------------------------
* CVE-2026-90460: Delegated tokens (like ec2credential,
    application_credential, ...) can GET/PATCH/DELETE any credential including
    TOTP seeds. Delegation project boundary not enforced on PATCH
    /v3/credentials/{id}. This was due to an incomplete fix for OSSA-2026-015.
    Applied upstream patch: "credentials: reject delegated tokens, restrict
    PATCH to blob only" (Closes: #1149303, #1149956):
    - CVE-2026-90460_lp-2159643_credentials_reject_delegated-tokens_re....patch
  * OSSN-0109: identity, credentials: require MFA re-verification for
    sensitive actions:
    - OSSN-0109_lp-2157347_invalidate_MFA_auth_receipts_and_TOTP_passco....patch
      (Closes: #1149305)
    - OSSN-0109_lp-2158970_identity_credentials_require_MFA_re-verifica....patch
      (Closes: #1149304)
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1149956

#1149956#16

Date:: 2026-10-06 17:44:18 UTC

From:

To:

Hello,

Bug #1149956 in keystone reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/openstack-team/services/keystone/-/commit/321ff5fec6779ed52961ba706680ba7838ae4531
------------------------------------------------------------------------
* CVE-2026-90460: Delegated tokens (like ec2credential,
    application_credential, ...) can GET/PATCH/DELETE any credential including
    TOTP seeds. Delegation project boundary not enforced on PATCH
    /v3/credentials/{id}. This was due to an incomplete fix for OSSA-2026-015.
    Applied upstream patch: "credentials: reject delegated tokens, restrict
    PATCH to blob only" (Closes: #1149303, #1149956):
    - CVE-2026-90460_lp-2159643_credentials_reject_delegated-tokens_re....patch
  * OSSN-0109: identity, credentials: require MFA re-verification for
    sensitive actions:
    - OSSN-0109_lp-2157347_invalidate_MFA_auth_receipts_and_TOTP_passco....patch
      (Closes: #1149305)
    - OSSN-0109_lp-2158970_identity_credentials_require_MFA_re-verifica....patch
      (Closes: #1149304)
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1149956

#1149956#19

Date:: 2026-10-06 17:46:00 UTC

From:

To:

Hello,

Bug #1149956 in keystone reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/openstack-team/services/keystone/-/commit/1498872d0da59e74c92b4b42ac35269c7ff8c9e5
------------------------------------------------------------------------
* CVE-2026-90460: Delegated tokens (like ec2credential,
    application_credential, ...) can GET/PATCH/DELETE any credential including
    TOTP seeds. Delegation project boundary not enforced on PATCH
    /v3/credentials/{id}. This was due to an incomplete fix for OSSA-2026-015.
    Applied upstream patch: "credentials: reject delegated tokens, restrict
    PATCH to blob only" (Closes: #1149303, #1149956):
    - CVE-2026-90460_lp-2159643_credentials_reject_delegated-tokens_re....patch
  * OSSN-0109: identity, credentials: require MFA re-verification for
    sensitive actions:
    - OSSN-0109_lp-2157347_invalidate_MFA_auth_receipts_and_TOTP_passco....patch
      (Closes: #1149305)
    - OSSN-0109_lp-2158970_identity_credentials_require_MFA_re-verifica....patch
      (Closes: #1149304)
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1149956

#1149956#22

Date:: 2026-10-06 17:46:09 UTC

From:

To:

Hello,

Bug #1149956 in keystone reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/openstack-team/services/keystone/-/commit/50c195201478d0cff46b7ea0667ee07973fc749e
------------------------------------------------------------------------
* CVE-2026-90460: Delegated tokens (like ec2credential,
    application_credential, ...) can GET/PATCH/DELETE any credential including
    TOTP seeds. Delegation project boundary not enforced on PATCH
    /v3/credentials/{id}. This was due to an incomplete fix for OSSA-2026-015.
    Applied upstream patch: "credentials: reject delegated tokens, restrict
    PATCH to blob only" (Closes: #1149303, #1149956):
    - CVE-2026-90460_lp-2159643_credentials_reject_delegated-tokens_re....patch
  * OSSN-0109: identity, credentials: require MFA re-verification for
    sensitive actions:
    - OSSN-0109_lp-2157347_invalidate_MFA_auth_receipts_and_TOTP_passco....patch
      (Closes: #1149305)
    - OSSN-0109_lp-2158970_identity_credentials_require_MFA_re-verifica....patch
      (Closes: #1149304)
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1149956

#1149956#25

Date:: 2026-10-06 17:47:54 UTC

From:

To:

Hello,

Bug #1149956 in keystone reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/openstack-team/services/keystone/-/commit/98e9818252d062c5e7cd3d133f8d39618d6264c4
------------------------------------------------------------------------
* CVE-2026-90460: Delegated tokens (like ec2credential,
    application_credential, ...) can GET/PATCH/DELETE any credential including
    TOTP seeds. Delegation project boundary not enforced on PATCH
    /v3/credentials/{id}. This was due to an incomplete fix for OSSA-2026-015.
    Applied upstream patch: "credentials: reject delegated tokens, restrict
    PATCH to blob only" (Closes: #1149303, #1149956):
    - CVE-2026-90460_lp-2159643_credentials_reject_delegated-tokens_re....patch
  * OSSN-0109: identity, credentials: require MFA re-verification for
    sensitive actions:
    - OSSN-0109_lp-2157347_invalidate_MFA_auth_receipts_and_TOTP_passco....patch
      (Closes: #1149305)
    - OSSN-0109_lp-2158970_identity_credentials_require_MFA_re-verifica....patch
      (Closes: #1149304)
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1149956

#1149956#28

Date:: 2026-10-06 17:48:00 UTC

From:

To:

Hello,

Bug #1149956 in keystone reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/openstack-team/services/keystone/-/commit/1232f36b5f9d25dcaaa9c49c1da4ae60f4dba7e3
------------------------------------------------------------------------
* CVE-2026-90460: Delegated tokens (like ec2credential,
    application_credential, ...) can GET/PATCH/DELETE any credential including
    TOTP seeds. Delegation project boundary not enforced on PATCH
    /v3/credentials/{id}. This was due to an incomplete fix for OSSA-2026-015.
    Applied upstream patch: "credentials: reject delegated tokens, restrict
    PATCH to blob only" (Closes: #1149303, #1149956):
    - CVE-2026-90460_lp-2159643_credentials_reject_delegated-tokens_re....patch
  * OSSN-0109: identity, credentials: require MFA re-verification for
    sensitive actions:
    - OSSN-0109_lp-2157347_invalidate_MFA_auth_receipts_and_TOTP_passco....patch
      (Closes: #1149305)
    - OSSN-0109_lp-2158970_identity_credentials_require_MFA_re-verifica....patch
      (Closes: #1149304)
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1149956

#1149956#31

Date:: 2026-10-06 17:48:31 UTC

From:

To:

Hello,

Bug #1149956 in keystone reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/openstack-team/services/keystone/-/commit/1a465a9a3438c87dff0e85ccdd421f675ed3a272
------------------------------------------------------------------------
* CVE-2026-90460: Delegated tokens (like ec2credential,
    application_credential, ...) can GET/PATCH/DELETE any credential including
    TOTP seeds. Delegation project boundary not enforced on PATCH
    /v3/credentials/{id}. This was due to an incomplete fix for OSSA-2026-015.
    Applied upstream patch: "credentials: reject delegated tokens, restrict
    PATCH to blob only" (Closes: #1149303, #1149956):
    - CVE-2026-90460_lp-2159643_credentials_reject_delegated-tokens_re....patch
  * OSSN-0109: identity, credentials: require MFA re-verification for
    sensitive actions:
    - OSSN-0109_lp-2157347_invalidate_MFA_auth_receipts_and_TOTP_passco....patch
      (Closes: #1149305)
    - OSSN-0109_lp-2158970_identity_credentials_require_MFA_re-verifica....patch
      (Closes: #1149304)
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1149956

#1149956#42

Date:: 2026-10-10 10:01:20 UTC

From:

To:

Hello,

Bug #1149956 in keystone reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/openstack-team/services/keystone/-/commit/d3ea766dee7bd1bf6738e0745f81c5f66883d222
------------------------------------------------------------------------
* CVE-2026-90460: Delegated tokens (like ec2credential,
    application_credential, ...) can GET/PATCH/DELETE any credential including
    TOTP seeds. Delegation project boundary not enforced on PATCH
    /v3/credentials/{id}. This was due to an incomplete fix for OSSA-2026-015.
    Applied upstream patch: "credentials: reject delegated tokens, restrict
    PATCH to blob only" (Closes: #1149303, #1149956):
    - CVE-2026-90460_lp-2159643_credentials_reject_delegated-tokens_re....patch
  * OSSN-0109: identity, credentials: require MFA re-verification for
    sensitive actions:
    - OSSN-0109_lp-2157347_invalidate_MFA_auth_receipts_and_TOTP_passco....patch
      (Closes: #1149305)
    - OSSN-0109_lp-2158970_identity_credentials_require_MFA_re-verifica....patch
      (Closes: #1149304)
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1149956

#1149956#49

Date:: 2026-10-17 14:33:36 UTC

From:

To:

We believe that the bug you reported is fixed in the latest version of
keystone, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1149303@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Thomas Goirand <zigo@debian.org> (supplier of updated keystone package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 06 Oct 2026 20:06:28 +0200
Source: keystone
Architecture: source
Version: 2:27.0.0-3+deb13u6
Distribution: trixie-security
Urgency: medium
Maintainer: Debian OpenStack <team+openstack@tracker.debian.org>
Changed-By: Thomas Goirand <zigo@debian.org>
Closes: 1149303 1149956
Changes:
 keystone (2:27.0.0-3+deb13u6) trixie-security; urgency=medium
 .
   * CVE-2026-90460: Delegated tokens (like ec2credential,
     application_credential, ...) can GET/PATCH/DELETE any credential including
     TOTP seeds. Delegation project boundary not enforced on PATCH
     /v3/credentials/{id}. Applied upstream patch: "credentials: reject
     delegated tokens, restrict PATCH to blob only" (Closes: #1149303,
     #1149956):
     - CVE-2026-90460_lp-2159643_credentials_reject_delegated-tokens_re....patch
Checksums-Sha1:
 09fd88588cc9be231326b8154bdadf9b23aaed84 3486 keystone_27.0.0-3+deb13u6.dsc
 896a6f57c727fa62d0aec10d5c8844b40cc42bdb 1098444 keystone_27.0.0.orig.tar.xz
 b56b31fc7f1763a4e22ad1f3f0c5e6e4c7daa68e 89448 keystone_27.0.0-3+deb13u6.debian.tar.xz
 8a49c1280ba3644a044f8e16894b4a4bc6f9ed07 18938 keystone_27.0.0-3+deb13u6_amd64.buildinfo
Checksums-Sha256:
 d8dad5550b5254809599adfb16330f07d124d9b92e5fa6ab28ab4602fb6a9ec7 3486 keystone_27.0.0-3+deb13u6.dsc
 223b27dc676dabd6c9d67e4409fe086f92b5d47bf71ee8c724c3e0d13f26d635 1098444 keystone_27.0.0.orig.tar.xz
 21a3dfd8904cf1616ed16a89c9f3e6daac6d287a7e17527c882298474eaf60c7 89448 keystone_27.0.0-3+deb13u6.debian.tar.xz
 99a44ba2dba5b08f78fb8260abbb9a26ff8dbe81212e9f0738fb6f1448941b0b 18938 keystone_27.0.0-3+deb13u6_amd64.buildinfo
Files:
 c3398356872e13542e0df92267c52f48 3486 net optional keystone_27.0.0-3+deb13u6.dsc
 d8119041a4ba1c4545ab5dabe9ae65b9 1098444 net optional keystone_27.0.0.orig.tar.xz
 d1af659b458b6f88b5ae55ad68ed56da 89448 net optional keystone_27.0.0-3+deb13u6.debian.tar.xz
 5a75b199114e065670506b0b3f364a10 18938 net optional keystone_27.0.0-3+deb13u6_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmrKDOEACgkQ1BatFaxr
Q/4zEBAAiTJpD6hJ4+9SptNDHk/6lr+kXoDO3634jbHEYVqUYh//O2SWNcKXM0ze
VN2NL2A76UC5uIlynSXa6jAoy7GJYNwTp4t0NX8be4HgINeaGrj+t+Z0swEmoAAZ
ptWCDmgLfahdq0zRgUDicJPT29cib60SoBPSTRgc1MOm4niChYA27mgw6uaLcrrT
n1u1NNXg60mx5Hgt8HChasac32Om/fzeqi1O/JoK4QfCyeglB8aIWZ7dZWUyvvAA
9FZsPE0rVnnYu16Aa3B8v/rMV7JZJ+8CU2gCn+dKNdelGyAzR30p4tM9UL5T+Ku4
TXkgRnUqvFtQbFN4G4mh2RSCZyJqhGH3E5jlqrwZIoMmBdtt7COv2RxXwaIkaKiC
tAWGGbHM8n8oF/8tvN9RukMoMALdlCqsiNZ5sX/BGr7MTxsjeojPlIbOsSwjQKSm
N+MeuELXJVNdeo9CZoiaR3uOxfenTx4/hBPIli2kj3iAcSf7hCDR2V/He4NGlDUX
KLAZsnm8I0LKY85PXMK6JAf6KCY2iR872m8se5WpjkUmnaykkBWBjci4v5ibsfk/
D3ApkPVa5UeXrgIV7Y1OzmDu4WhrzgGJifAIkhunbFneA78Ym7N2q0f/nfqXXjGw
blZz99ysALPx8vvC1wcwyUAYq0f75JbsXFlVslO8zuqnmU3EdlA=
=y9oi
-----END PGP SIGNATURE-----

#1149956#54

Date:: 2026-10-17 14:33:36 UTC

From:

To:

We believe that the bug you reported is fixed in the latest version of
keystone, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1149956@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Thomas Goirand <zigo@debian.org> (supplier of updated keystone package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 06 Oct 2026 20:06:28 +0200
Source: keystone
Architecture: source
Version: 2:27.0.0-3+deb13u6
Distribution: trixie-security
Urgency: medium
Maintainer: Debian OpenStack <team+openstack@tracker.debian.org>
Changed-By: Thomas Goirand <zigo@debian.org>
Closes: 1149303 1149956
Changes:
 keystone (2:27.0.0-3+deb13u6) trixie-security; urgency=medium
 .
   * CVE-2026-90460: Delegated tokens (like ec2credential,
     application_credential, ...) can GET/PATCH/DELETE any credential including
     TOTP seeds. Delegation project boundary not enforced on PATCH
     /v3/credentials/{id}. Applied upstream patch: "credentials: reject
     delegated tokens, restrict PATCH to blob only" (Closes: #1149303,
     #1149956):
     - CVE-2026-90460_lp-2159643_credentials_reject_delegated-tokens_re....patch
Checksums-Sha1:
 09fd88588cc9be231326b8154bdadf9b23aaed84 3486 keystone_27.0.0-3+deb13u6.dsc
 896a6f57c727fa62d0aec10d5c8844b40cc42bdb 1098444 keystone_27.0.0.orig.tar.xz
 b56b31fc7f1763a4e22ad1f3f0c5e6e4c7daa68e 89448 keystone_27.0.0-3+deb13u6.debian.tar.xz
 8a49c1280ba3644a044f8e16894b4a4bc6f9ed07 18938 keystone_27.0.0-3+deb13u6_amd64.buildinfo
Checksums-Sha256:
 d8dad5550b5254809599adfb16330f07d124d9b92e5fa6ab28ab4602fb6a9ec7 3486 keystone_27.0.0-3+deb13u6.dsc
 223b27dc676dabd6c9d67e4409fe086f92b5d47bf71ee8c724c3e0d13f26d635 1098444 keystone_27.0.0.orig.tar.xz
 21a3dfd8904cf1616ed16a89c9f3e6daac6d287a7e17527c882298474eaf60c7 89448 keystone_27.0.0-3+deb13u6.debian.tar.xz
 99a44ba2dba5b08f78fb8260abbb9a26ff8dbe81212e9f0738fb6f1448941b0b 18938 keystone_27.0.0-3+deb13u6_amd64.buildinfo
Files:
 c3398356872e13542e0df92267c52f48 3486 net optional keystone_27.0.0-3+deb13u6.dsc
 d8119041a4ba1c4545ab5dabe9ae65b9 1098444 net optional keystone_27.0.0.orig.tar.xz
 d1af659b458b6f88b5ae55ad68ed56da 89448 net optional keystone_27.0.0-3+deb13u6.debian.tar.xz
 5a75b199114e065670506b0b3f364a10 18938 net optional keystone_27.0.0-3+deb13u6_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmrKDOEACgkQ1BatFaxr
Q/4zEBAAiTJpD6hJ4+9SptNDHk/6lr+kXoDO3634jbHEYVqUYh//O2SWNcKXM0ze
VN2NL2A76UC5uIlynSXa6jAoy7GJYNwTp4t0NX8be4HgINeaGrj+t+Z0swEmoAAZ
ptWCDmgLfahdq0zRgUDicJPT29cib60SoBPSTRgc1MOm4niChYA27mgw6uaLcrrT
n1u1NNXg60mx5Hgt8HChasac32Om/fzeqi1O/JoK4QfCyeglB8aIWZ7dZWUyvvAA
9FZsPE0rVnnYu16Aa3B8v/rMV7JZJ+8CU2gCn+dKNdelGyAzR30p4tM9UL5T+Ku4
TXkgRnUqvFtQbFN4G4mh2RSCZyJqhGH3E5jlqrwZIoMmBdtt7COv2RxXwaIkaKiC
tAWGGbHM8n8oF/8tvN9RukMoMALdlCqsiNZ5sX/BGr7MTxsjeojPlIbOsSwjQKSm
N+MeuELXJVNdeo9CZoiaR3uOxfenTx4/hBPIli2kj3iAcSf7hCDR2V/He4NGlDUX
KLAZsnm8I0LKY85PXMK6JAf6KCY2iR872m8se5WpjkUmnaykkBWBjci4v5ibsfk/
D3ApkPVa5UeXrgIV7Y1OzmDu4WhrzgGJifAIkhunbFneA78Ym7N2q0f/nfqXXjGw
blZz99ysALPx8vvC1wcwyUAYq0f75JbsXFlVslO8zuqnmU3EdlA=
=y9oi
-----END PGP SIGNATURE-----

#1149956 keystone: CVE-2026-90460 #1149956

Just Reply to ...

Reply to submitter ...

Send control command (Silently)

Set Architecture Tags (Silently)