PT-2026-82359 · Openstack · Openstack Keystone
CVSS v4.0
7.1
High
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
OpenStack Keystone versions prior to 29.0.3
Description
An authenticated user with the
role:reader role on any project can list all project-scoped role assignments under any domain. This occurs when a domain ID is passed as scope.project.id with include subtree to the 'GET /v3/role assignments' endpoint. Because the domain project record has domain id=null, the policy check is bypassed. Using include names allows the disclosure of names and home-domain IDs for all involved users, groups, projects, and roles. This issue stems from the misuse of None in the list role assignments for tree() function. An attacker can use the "default" domain ID in bootstrap deployments to harvest domain IDs and map role assignments across the entire cloud.Recommendations
Update OpenStack Keystone to version 29.0.3 or later.
Fix
Type Confusion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Openstack Keystone