PT-2026-82359
CVE-2026-80183
·
تاريخ النشر
2026-08-26
·
تاريخ التحديث
2026-09-30
الوصف من
CVSS 4.0
7.1
عاليةالمقاييسAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
OpenStack Keystone versions prior to 29.0.3
Description
An authenticated user with the
role:reader role on any project can list all project-scoped role assignments under any domain. This occurs when a domain ID is passed as scope.project.id with include subtree to the 'GET /v3/role assignments' endpoint. Because the domain project record has domain id=null, the policy check is bypassed. Using include names allows the disclosure of names and home-domain IDs for all involved users, groups, projects, and roles. This issue stems from the misuse of None in the list role assignments for tree() function. An attacker can use the "default" domain ID in bootstrap deployments to harvest domain IDs and map role assignments across the entire cloud.Recommendations
Update OpenStack Keystone to version 29.0.3 or later.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾