PT-2026-90507
CVE-2026-90460
·
Published
2026-09-11
·
Updated
2026-10-13
Description by
CVSS 4.0
7.6
HighMetricsAV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
OpenStack Keystone versions prior to 29.0.3
Description
Tokens obtained through delegated authentication methods, including EC2 credentials, application credentials, OAuth1 access tokens, and trusts, are not restricted from creating, modifying, or deleting credentials via the '/v3/credentials' API endpoint. Specifically, tokens derived from EC2 can read credential blobs, which exposes other secrets and TOTP MFA seeds (Time-based One-Time Password Multi-Factor Authentication). Additionally, the 'PATCH /v3/credentials' endpoint fails to validate the
project id requested during an update, enabling any delegated token to move a credential to an unauthorized project.Recommendations
Update to version 29.0.3 or later.
Restrict access to the '/v3/credentials' API endpoint for tokens using delegated authentication methods until the update is applied.
Found an issue in the description? Have something to add? Feel free to write us 👾