#1152543 CVE-2026-115642 / OSSA-2026-050: keystonemiddleware access_rules bypass via X-Service-Token #1152543
- Package:
- src:python-keystonemiddleware
- Source:
- src:python-keystonemiddleware
- Submitter:
- Thomas Goirand
- Date:
- 2026-10-30 13:51:01 UTC
- Severity:
- normal
- Tags:
As per upstream announce at: https://security.openstack.org/ossa/OSSA-2026-050.html Date: October 29, 2026 :CVE: CVE-2026-115642 Affects ~~~~~~~ - Keystonemiddleware: <10.9.2, >=10.10.0 <10.12.2, >=11.0.0 <12.0.1, >=13.0.0 <13.0.2 Description ~~~~~~~~~~~ Nassim Abbaoui with OVHcloud reported a vulnerability in keystonemiddleware application credential access_rules enforcement. By supplying a custom X-Service-Token header in a request, anyone in posession of an access-restricted application credential may bypass those restrictions resulting in elevation of privileges. Deployments that use application credential access_rules, or that enforce token binding, are affected. Patches ~~~~~~~ - https://review.opendev.org/1012874 (2025.1/epoxy) - https://review.opendev.org/1012873 (2025.2/flamingo) - https://review.opendev.org/1012872 (2026.1/gazpacho) - https://review.opendev.org/1012871 (2026.2/hibiscus) - https://review.opendev.org/1012869 (2027.1/indri (development)) Credits ~~~~~~~ - Nassim Abbaoui from OVHcloud (CVE-2026-115642) References ~~~~~~~~~~ - https://launchpad.net/bugs/2162748 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-115642
Hello, Bug #1152543 in python-keystonemiddleware reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/libs/python-keystonemiddleware/-/commit/ac66263fa2d128d64495324fa3f0b6f462af65e5 bypass of access_rules and token bind". (Closes: #1152543). - CVE-2026-115642_OSSA-2026-050_Fix_service_token_presence_bypass_o....patch ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1152543
Hello, Bug #1152543 in python-keystonemiddleware reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/libs/python-keystonemiddleware/-/commit/d152d4f565a29f9c1cdcde1331ad145714177294 bypass of access_rules and token bind". (Closes: #1152543). - CVE-2026-115642_OSSA-2026-050_Fix_service_token_presence_bypass_o....patch ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1152543
Hello, Bug #1152543 in python-keystonemiddleware reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/libs/python-keystonemiddleware/-/commit/efa38927e4f368afa2ac02d50f395ca70d122a92 bypass of access_rules and token bind". (Closes: #1152543). - CVE-2026-115642_OSSA-2026-050_Fix_service_token_presence_bypass_o....patch ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1152543
Hello, Bug #1152543 in python-keystonemiddleware reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/libs/python-keystonemiddleware/-/commit/633d9728c9576f74463aab0b0fce1c059ad8bd13 bypass of access_rules and token bind". (Closes: #1152543). - CVE-2026-115642_OSSA-2026-050_Fix_service_token_presence_bypass_o....patch ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1152543
Hello, Bug #1152543 in python-keystonemiddleware reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/libs/python-keystonemiddleware/-/commit/d8ecd31da1cae38e638e6812184260fcaa236037 bypass of access_rules and token bind". (Closes: #1152543). - CVE-2026-115642_OSSA-2026-050_Fix_service_token_presence_bypass_o....patch ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1152543
We believe that the bug you reported is fixed in the latest version of
python-keystonemiddleware, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 1152543@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Thomas Goirand <zigo@debian.org> (supplier of updated python-keystonemiddleware package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Fri, 30 Oct 2026 14:15:09 +0100
Source: python-keystonemiddleware
Architecture: source
Version: 13.0.1-5
Distribution: unstable
Urgency: high
Maintainer: Debian OpenStack <team+openstack@tracker.debian.org>
Changed-By: Thomas Goirand <zigo@debian.org>
Closes: 1152543
Changes:
python-keystonemiddleware (13.0.1-5) unstable; urgency=high
.
* CVE-2026-115642 / OSSA-2026-050: keystonemiddleware access_rules bypass
via X-Service-Token. Applied upstream patch "Fix service-token presence
bypass of access_rules and token bind". (Closes: #1152543):
- CVE-2026-115642_OSSA-2026-050_Fix_service_token_presence_bypass_o....patch
Checksums-Sha1:
a672c238d0aef6959c38c252f7f5cc55c9058ffc 3161 python-keystonemiddleware_13.0.1-5.dsc
89bfb7a68b9de56aae814f6bde92dbfae30560ad 9328 python-keystonemiddleware_13.0.1-5.debian.tar.xz
26d7aaa2b57d557be3e00ce4f0a74a1d70bcb9e1 18731 python-keystonemiddleware_13.0.1-5_amd64.buildinfo
Checksums-Sha256:
ea33cb1f4ce72266ac716457620a155853f2e2bd90dc2266d9ed33b9f3909526 3161 python-keystonemiddleware_13.0.1-5.dsc
311452593bed9eb69d39d294fb912dc53dd09a4ad021822fffb07ef1b7d7ca46 9328 python-keystonemiddleware_13.0.1-5.debian.tar.xz
cc7db548b0ef24402ec3a5a712eae63dbfae5df3ea87b949dac22385ebcbdbb3 18731 python-keystonemiddleware_13.0.1-5_amd64.buildinfo
Files:
5c548860fcecf0c55bc9107b420928ce 3161 python optional python-keystonemiddleware_13.0.1-5.dsc
f25be7880942340f21d4c6de9bcd7015 9328 python optional python-keystonemiddleware_13.0.1-5.debian.tar.xz
9fde43847d65014133908ce75431d16e 18731 python optional python-keystonemiddleware_13.0.1-5_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmrkmYIACgkQ1BatFaxr
Q/7WlQ//YLhdY229wVZ10cQQZDgqef+iqdeOVYDAIIoG3JlyjRVL/DHU7OJTAvma
iYoE7eWOPEiYmKZiPY5mG6fz1X9MP3zu8vll1apEujffSZ5u1FOFG9R/qzDFOVcs
M8XxHGqfqpyET3fR63WWvSWsaLot6FyvCl9vh4B01pLNCcp8dJsMf4fh6dKbTtiW
a2DEzPpUZm9vFJw5BnDENEEd2xhvUAIxATuzMA0b5+owxhAJPExIYKuoq/ROAHmV
Y2MyhWQNmCW0R/myAEpHc7dTZXheKdh3poRqxJVw3RPv5zvwFUQykmWJcVqPUvuu
2BpDIlaMuQTABAlLs+6y9b4ZSNr1MePjvlSLDfvUlqQPx2JE2d/Rg0yzP0Ki+Vk3
7hLCE9aCGkVEyUIGKkkXsOUaU6BPzpsSSgqLFN0UH2UJYDZnicRpFVdX9zq/0PjB
uyyzmGyQjwTfP3iAixK7MkZCSdnnV1btgB40nDJarm79NUpG6glN2WaV7BVPryMg
D+UNNTqSmbSLtspO1L9dd3+7M67K54iLnTQS/r+Tv+6L0hl76kHHDTfMRlRWYTjv
MWtRs/ZsBGH81zof1ZJUPB4ADgNHddPPvniYPoL3WGHztepxuaRE2YV/kbrTHT8R
SALaDB/01Efd0BEA0adzYaRRywFE2Oa5eEGLvApdzlynvaTeAQg=
=MuKz
-----END PGP SIGNATURE-----