CVE-2026-80182
CVE-2026-80182: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityHigh8.1
High [CVE-2026-80182] Delegated token scope restrictions not consistently enforced across trust, OAuth1, and application credential endpoints
CVE-2026-80182Source published Source updated
In OpenStack Keystone before 29.0.3, tokens obtained via OAuth1 access token, application credential, or trust-scoped authentication could create new long-lived credentials or authorize new delegations that persist independently of, and outlive, the credential used to obtain them. The delegation restrictions that block these operations did not consistently apply to all delegated token types, allowing an OAuth1-scoped token, for example, to create application credentials or authorize OAuth1 request tokens despite those operations being restricted for other delegated token types. All Keystone deployments that permit delegated authentication through OAuth1 access tokens, application credentials, or trusts are affected. A flaw was found in OpenStack Keystone where delegation boundary…
- Affected products in this advisory
- Red Hat OpenStack Platform 16.2
- Red Hat OpenStack Platform 17.1
- Red Hat OpenStack Platform 18.0
- Source-reported affected versions
- < 29.0.3
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- There is no complete mitigation for this vulnerability. The following measures can reduce risk: 1. If OAuth1 authentication is not required, remove 'oauth1' from the [auth] methods configuration option in keystone.conf. 2. Restrict access to the Keystone API to trusted networks via firewall rules. 3. Review and rotate application credentials, trusts, and OAuth1 access tokens after a suspected compromise.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.