Bbobrov

**Name of the Vulnerable Software and Affected Versions** OpenStack Keystone versions prior to 29.0.3 **Description** An authenticated user with the `role:reader` role on any project can list all project-scoped role assignments under any domain. This occurs when a domain ID is passed as `scope.project.id` with `include subtree` to the 'GET /v3/role assignments' endpoint. Because the domain project record has `domain id=null`, the policy check is bypassed. Using `include names` allows the disclosure of names and home-domain IDs for all involved users, groups, projects, and roles. This issue stems from the misuse of `None` in the `list role assignments for tree()` function. An attacker can use the "default" domain ID in bootstrap deployments to harvest domain IDs and map role assignments across the entire cloud. **Recommendations** Update OpenStack Keystone to version 29.0.3 or later.