CVE-2026-90460

Received Received - Intake

Authentication Bypass in OpenStack Keystone via Delegated Tokens

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: MITRE

Description

An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods (EC2 credentials, application credentials, OAuth1 access tokens, and trusts) are not blocked from creating, modifying, or deleting credentials via the /v3/credentials API. EC2-derived tokens can additionally read credential blobs, exposing TOTP MFA seeds and other secrets. Also, PATCH /v3/credentials does not validate the requested post-update project_id, allowing any delegated token to move a credential to an unauthorized project. All Keystone deployments using delegated authentication are affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-90460

Affected Vendors & Products

Vendor	Product	Version / Range
openstack	keystone	to 29.0.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability affects OpenStack Keystone before version 29.0.3. Tokens created through delegated authentication methods like EC2 credentials, application credentials, OAuth1 access tokens, and trusts can be used to manage credentials via the /v3/credentials API. EC2-derived tokens can also read sensitive credential data such as TOTP MFA seeds. Additionally, the PATCH /v3/credentials endpoint does not properly validate project_id changes, allowing unauthorized project access.

Detection Guidance

To detect this vulnerability, check OpenStack Keystone logs for unusual activity on the /v3/credentials API endpoint. Look for requests from tokens obtained via delegated authentication methods (EC2 credentials, application credentials, OAuth1 access tokens, or trusts). Verify if credentials are being created, modified, or deleted without proper authorization. Also, inspect PATCH requests to /v3/credentials for invalid project_id changes.

Impact Analysis

An attacker with access to delegated tokens could create, modify, or delete credentials, potentially gaining unauthorized access to systems. They could also read sensitive data like MFA seeds, bypassing security controls. Unauthorized project access could lead to data leakage or privilege escalation within the OpenStack environment.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Exposure of MFA seeds or other secrets may compromise authentication mechanisms, leading to potential non-compliance with security controls mandated by these regulations.

Mitigation Strategies

Upgrade OpenStack Keystone to version 29.0.3 or later to address the vulnerability. Review and restrict access to the /v3/credentials API endpoint. Audit existing credentials and tokens for unauthorized access or modifications.

Hi! I’m here to help you understand CVE-2026-90460. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70