CVE-2026-80183 Overview
CVE-2026-80183 is an authorization bypass vulnerability in OpenStack Keystone versions before 29.0.3. Any authenticated user holding role:reader on any project can enumerate every project-scoped role assignment under any domain. The flaw resides in the GET /v3/role_assignments endpoint when a caller supplies a domain ID as scope.project.id along with include_subtree. Keystone's domain record has domain_id=null, which causes the policy domain_id check to succeed for any caller. Combined with include_names, the response reveals user, group, project, and role identifiers across the entire cloud.
Critical Impact
An authenticated low-privilege reader can map role assignments cloud-wide, exposing user, group, project, and role identities across every domain.
Affected Products
- OpenStack Keystone versions prior to 29.0.3
- Deployments bootstrapped via keystone-manage bootstrap using the literal default domain ID
- Multi-domain OpenStack clouds relying on Keystone role-based access control (RBAC)
Discovery Timeline
- 2026-08-27 - CVE-2026-80183 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-80183
Vulnerability Analysis
The defect is a type confusion issue [CWE-843] in Keystone's list_role_assignments_for_tree function. Keystone treats a domain identifier as a project identifier when the caller submits it through scope.project.id. Because the domain's underlying project record stores domain_id=null, the policy engine's domain-scoped comparison passes for any authenticated caller. The API then walks the project tree under that domain and returns all role assignments beneath it.
When include_names=true is added to the request, Keystone enriches the response with human-readable identifiers. This turns a scoped listing bug into a directory-style disclosure of users, groups, projects, roles, and their home-domain IDs. An attacker uses the initial response to harvest additional domain IDs, then repeats the query to enumerate every role assignment in the deployment.
Root Cause
The root cause is the misuse of Python's None value for the domain_id attribute of domain-projects inside list_role_assignments_for_tree. The comparison record.domain_id == caller_domain_id evaluates against None, defeating the intended access boundary and permitting cross-domain enumeration.
Attack Vector
Exploitation requires network access to the Keystone Identity API and any project-scoped reader role. The attacker issues an authenticated GET /v3/role_assignments request with scope.project.id=<domain_id>, include_subtree=true, and include_names=true. The literal default domain ID works against any deployment created with keystone-manage bootstrap. The attacker then extracts additional domain IDs from the response and iterates until the entire cloud's role assignments are enumerated. See the Launchpad Bug Report #2154645 for full technical detail.
Detection Methods for CVE-2026-80183
Indicators of Compromise
- Authenticated GET /v3/role_assignments requests containing both include_subtree=true and include_names=true originating from low-privilege reader accounts.
- Keystone API calls where scope.project.id matches a known domain ID such as default.
- Sudden spikes in /v3/role_assignments traffic from a single token or source IP over short time windows.
Detection Strategies
- Parse Keystone API access logs for scope.project.id values that resolve to domain identifiers rather than project identifiers.
- Correlate response sizes on /v3/role_assignments with caller role; readers should not receive multi-domain payloads.
- Alert on repeated queries iterating through domain IDs harvested from prior responses.
Monitoring Recommendations
- Forward Keystone access and audit logs to a centralized analytics platform for query-pattern analysis.
- Track baseline volumes of role_assignments calls per token, and flag deviations.
- Enable Keystone's CADF audit notifications and monitor identity.role_assignment events.
How to Mitigate CVE-2026-80183
Immediate Actions Required
- Upgrade OpenStack Keystone to version 29.0.3 or later on all controllers.
- Rotate any tokens held by accounts that may have queried /v3/role_assignments since the vulnerable version was deployed.
- Audit existing role assignments to confirm no unauthorized grants were added following suspected reconnaissance.
Patch Information
The OpenStack Keystone project fixed the flaw in release 29.0.3 by correcting the None-handling logic in list_role_assignments_for_tree. Refer to the Launchpad Bug Report #2154645 for the upstream fix and backport details for supported stable branches.
Workarounds
- Restrict network access to the Keystone Identity API so only trusted management networks can reach /v3/role_assignments.
- Remove unnecessary reader role grants and review project-level RBAC assignments to reduce the attacker population.
- Deploy a policy override that rejects requests to /v3/role_assignments where scope.project.id corresponds to a domain identifier until the patch is applied.
# Verify installed Keystone version and upgrade if below 29.0.3
pip show keystone | grep -i version
pip install --upgrade 'keystone>=29.0.3'
systemctl restart httpd
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
