High [CVE-2026-80182] Delegated token scope restrictions not consistently enforced across trust, OAuth1, and application credential endpoints
This high-severity Red Hat Linux advisory covers CVE-2026-80182 affecting Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1, Red Hat OpenStack Platform 18.0.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Summary
In OpenStack Keystone before 29.0.3, tokens obtained via OAuth1 access token, application credential, or trust-scoped authentication could create new long-lived credentials or authorize new delegations that persist independently of, and outlive, the credential used to obtain them.
The delegation restrictions that block these operations did not consistently apply to all delegated token types, allowing an OAuth1-scoped token, for example, to create application credentials or authorize OAuth1 request tokens despite those operations being restricted for other delegated token types.
All Keystone deployments that permit delegated authentication through OAuth1 access tokens, application credentials, or trusts are affected. A flaw was found in OpenStack Keystone where delegation boundary enforcement is incomplete across trust, application credential, and OAuth1 authorization endpoints.
Tokens obtained via delegated authentication methods, such as OAuth1 access tokens or custom Keystone authentication plugins, can perform operations beyond their intended scope because endpoint guards only recognized specific delegation types rather than using a comprehensive allowlist.
This allows creating trusts that delegate roles beyond the token's authorized scope, creating persistent application credentials, and authorizing new OAuth1 delegations.
- < 29.0.3
Official advisory · high-confidence parse· fetched 13 days ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 13 days ago·verify at source
Mitigation checklist
- There is no complete mitigation for this vulnerability. The following measures can reduce risk: 1. If OAuth1 authentication is not required, remove 'oauth1' from the [auth] methods configuration option in keystone.conf. 2. Restrict access to the Keystone API to trusted networks via firewall rules. 3. Review and rotate application credentials, trusts, and OAuth1 access tokens after a suspected compromise.
Official advisory · high-confidence parse· fetched 13 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.