CVE-2026-80182: OpenStack Keystone Auth Bypass Vulnerability

CVE-2026-80182 Overview

CVE-2026-80182 is an authorization flaw in OpenStack Keystone before version 29.0.3. Tokens obtained through OAuth1 access tokens, application credentials, or trust-scoped authentication can create new long-lived credentials or authorize new delegations. These new credentials persist independently of, and outlive, the credential used to obtain them. The delegation restrictions intended to block these operations do not consistently apply to all delegated token types. An OAuth1-scoped token, for example, can create application credentials or authorize OAuth1 request tokens even though those operations are restricted for other delegated token types. The vulnerability is categorized as an incorrect authorization weakness [CWE-863].

Critical Impact
Attackers holding a short-lived delegated token can mint long-lived credentials that survive revocation of the originating token, expanding blast radius and persistence within OpenStack deployments.

Affected Products

OpenStack Keystone versions prior to 29.0.3
Deployments permitting delegated authentication via OAuth1 access tokens
Deployments permitting delegated authentication via application credentials or trusts

Discovery Timeline

2026-08-25 - CVE-2026-80182 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-80182

Vulnerability Analysis

OpenStack Keystone is the identity service that provides authentication, authorization, and service discovery for OpenStack clouds. It supports several delegated authentication mechanisms including OAuth1, application credentials, and trusts. These mechanisms are designed to allow a principal to delegate a limited subset of their privileges to another actor for a bounded period.

Keystone enforces restrictions that prevent delegated tokens from creating additional persistent credentials. The intent is that a delegated token cannot escape its temporal and scope constraints by generating new delegations that outlive it. This vulnerability breaks that guarantee because the restriction logic is not applied uniformly across all delegated token types.

An actor holding an OAuth1 access token, application credential token, or trust-scoped token can invoke credential-creation and delegation-authorization endpoints that should be denied. The newly minted credentials are independent objects tied to the original user, so revoking the source token does not revoke the derived credentials.

Root Cause

The root cause is inconsistent enforcement of delegation restrictions across token types. Keystone maintains checks that block creation of application credentials, OAuth1 request token authorization, and trust creation when the acting token is itself delegated. The checks did not cover every delegated token path, allowing at least one delegated token type to authorize operations restricted for others. This is a classic incorrect authorization flaw where the policy exists but is not applied consistently across the code paths that need it.

Attack Vector

The attack requires the adversary to first obtain a valid delegated token, meaning some prerequisite compromise or legitimate delegation must exist. Once the attacker holds an OAuth1 access token, application credential, or trust-scoped token, they issue standard Keystone API calls to /v3/credentials, /v3/users/{user_id}/application_credentials, or the OAuth1 request-token authorization endpoint. Keystone accepts the request and creates a new credential bound to the underlying user. The attacker then uses the derived credential for persistent access, potentially with a longer lifetime and different scope than the original delegation permitted.

No verified public exploit code is available. Refer to the OpenStack Security Advisory OSSA-2026-037 and the Launchpad Bug Report #2153453 for technical details on the vulnerable code paths.

Detection Methods for CVE-2026-80182

Indicators of Compromise

Creation of application credentials or trusts where the source authentication method in Keystone audit logs is oauth1, application_credential, or token derived from a trust.
OAuth1 request tokens authorized by a session that was itself established using a delegated token.
New long-lived credentials appearing on user accounts that predominantly authenticate through federated or delegated flows.

Detection Strategies

Enable Keystone notification events and audit middleware, then correlate identity.application_credential.created, identity.trust.created, and identity.OS-OAUTH1.* events with the parent token type used to authorize them.
Alert when the initiator of a credential-creation event references a token whose authentication methods include oauth1, application_credential, or token inherited from a trust.
Baseline expected credential-creation actors and flag deviations, particularly service accounts or human users that suddenly begin minting credentials programmatically.

Monitoring Recommendations

Forward Keystone logs and CADF audit events to a centralized analytics platform for correlation with cloud API activity.
Track counts of active application credentials and trusts per user over time and investigate sudden growth.
Monitor keystone.common.wsgi warnings and 403 responses on delegation endpoints to identify probing after patching.

How to Mitigate CVE-2026-80182

Immediate Actions Required

Upgrade OpenStack Keystone to version 29.0.3 or later.
Inventory all existing application credentials, trusts, and OAuth1 consumers and revoke any that cannot be attributed to a legitimate creator.
Rotate credentials for any user whose delegated tokens may have been abused prior to patching.
Review Keystone audit logs for credential and trust creation events sourced from delegated tokens across the exposure window.

Patch Information

The fix is included in OpenStack Keystone 29.0.3. Consult the OpenStack Security Advisory OSSA-2026-037 and the Openwall OSS-Security Discussion for backport availability across supported OpenStack releases. Apply distribution-provided packages where operators deploy Keystone from vendor repositories.

Workarounds

Disable OAuth1 authentication in keystone.conf if it is not required by workloads.
Restrict application credential creation using Keystone policy rules until the patch is deployed.
Reduce the default lifetime of application credentials and trusts to limit persistence of any credentials minted through this flaw.

bash

# Example: restrict application credential creation via policy.yaml
# Deny creation when the acting token was obtained through delegation
"identity:create_application_credential": "rule:owner and not (token.is_delegated_auth)"
"identity:create_trust": "rule:admin_required and not (token.is_delegated_auth)"

# Disable OAuth1 endpoints in keystone-paste.ini if unused
# Remove the 'oauth1' extension from the [pipeline:api_v3] pipeline