CVE-2026-80184

Undergoing Analysis Undergoing Analysis - In Progress

Token Scope Bypass in OpenStack Keystone

Publication date: 2026-08-25

Last updated on: 2026-09-03

Assigner: MITRE

Description

In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms (OAuth1 access tokens, application credentials, trusts) could be submitted to the token-method authentication path for reauthentication to escape their intended project scope. When an application credential token was presented with no explicit scope, Keystone would issue a new token scoped to the credential owner's default project rather than the project for which the credential was issued, bypassing the intended project boundary. All Keystone deployments that permit delegated authentication through OAuth1 access tokens, application credentials, or trusts are affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-25

Last Modified

2026-09-03

Generated

2026-09-16

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-14

NVD

CVE-2026-80184

EUVD

EUVD-2026-66121

Affected Vendors & Products

Vendor	Product	Version / Range
openstack	keystone	to 29.0.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

In OpenStack Keystone before version 29.0.3, tokens from delegated authentication methods like OAuth1 access tokens, application credentials, or trusts could be reused to gain broader access. Specifically, application credential tokens without an explicit scope could be reauthenticated to receive a new token scoped to the owner's default project instead of the intended project, bypassing project boundaries.

Detection Guidance

To detect this vulnerability, check OpenStack Keystone logs for authentication attempts using OAuth1 access tokens, application credentials, or trusts. Look for tokens submitted to the token-method authentication path without explicit scope. Verify if tokens are reissued with incorrect project scopes. Use commands like 'openstack token validate' to inspect token details and 'openstack token issue' to check scope assignments.

Impact Analysis

This vulnerability allows an attacker with a delegated token to escalate privileges and access resources outside their intended project scope. This could lead to unauthorized data access, privilege escalation, or lateral movement within the OpenStack environment.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized access to sensitive data, undermining data segregation controls required by GDPR and HIPAA. It may lead to data breaches, non-compliance penalties, and loss of trust in data handling practices.

Mitigation Strategies

Upgrade OpenStack Keystone to version 29.0.3 or later to address the token scope bypass issue. Review and restrict delegated authentication mechanisms like OAuth1, application credentials, and trusts until patched.

Hi! I’m here to help you understand CVE-2026-80184. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70