CVE-2026-90460: OpenStack Keystone Auth Bypass Vulnerability

CVE-2026-90460 Overview

CVE-2026-90460 is an authorization flaw [CWE-863] in OpenStack Keystone versions before 29.0.3. The vulnerability allows tokens obtained through delegated authentication methods to perform credential operations they should not be authorized to execute. Affected delegation mechanisms include EC2 credentials, application credentials, OAuth1 access tokens, and trusts. Delegated tokens can create, modify, or delete entries via the /v3/credentials API without proper authorization checks. EC2-derived tokens can additionally read credential blobs, exposing TOTP multi-factor authentication (MFA) seeds and other secrets. All Keystone deployments using delegated authentication are affected.

Critical Impact
Delegated tokens can read, modify, and reassign credentials across projects, exposing TOTP MFA seeds and enabling lateral movement across OpenStack tenants.

Affected Products

OpenStack Keystone versions before 29.0.3
All Keystone deployments using EC2 credentials or application credentials
All Keystone deployments using OAuth1 access tokens or trusts

Discovery Timeline

2026-09-11 - CVE-2026-90460 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90460

Vulnerability Analysis

The flaw resides in Keystone's authorization logic for the /v3/credentials API endpoint. Keystone issues tokens through several delegated authentication paths, including EC2 credentials, application credentials, OAuth1 access tokens, and trusts. These delegation mechanisms are intended to grant narrow, scoped access to services on behalf of a user.

Keystone fails to reject delegated tokens when they invoke credential management operations. As a result, a token issued for a specific service purpose can create, update, or delete arbitrary credential records. EC2-derived tokens compound the issue by permitting reads of credential blob contents, which include TOTP MFA seeds and other secret material.

A separate defect in PATCH /v3/credentials allows an attacker to reassign a credential to any project. The endpoint does not validate the requested post-update project_id against the caller's authorization scope.

Root Cause

The root cause is missing authorization enforcement [CWE-863] on the credentials API. Keystone's policy layer does not distinguish delegated tokens from fully-scoped user tokens when evaluating credential write and read operations. The PATCH handler additionally omits validation of the target project_id, permitting cross-project reassignment.

Attack Vector

An attacker who holds any delegated token, such as an application credential issued for a CI/CD pipeline, can call the credentials API to enumerate, modify, or delete credentials. With an EC2-derived token, the attacker can read stored MFA seeds and reconstruct one-time passwords for privileged accounts. Using PATCH, the attacker can move a credential into an unauthorized project to hijack access. See Launchpad Bug #2158931 and Launchpad Bug #2159643 for technical details.

No verified public exploit code is available. The vulnerability is described in prose rather than through synthesized proof-of-concept code.

Detection Methods for CVE-2026-90460

Indicators of Compromise

Requests to /v3/credentials (POST, PATCH, DELETE) where the authenticating token was issued via EC2 credentials, application credentials, OAuth1, or trusts.
GET /v3/credentials/{credential_id} calls from EC2-derived tokens returning credential blob contents.
PATCH /v3/credentials/{credential_id} requests that modify the project_id field to a project outside the caller's normal scope.
Unexpected creation or deletion of TOTP credential records in Keystone audit logs.

Detection Strategies

Parse Keystone audit and access logs for credential API calls correlated with delegated token issuers (token_id metadata indicating application_credential, ec2credential, oauth1, or trust).
Alert on any credential project_id change and compare source and destination project against the caller's role assignments.
Baseline normal credential API usage per service account and flag deviations, particularly bulk reads or deletes.

Monitoring Recommendations

Enable Keystone notifications on the identity.credential.* event types and forward them to a centralized SIEM.
Monitor authentication flows that produce delegated tokens and correlate them with subsequent credential API access.
Track TOTP enrollment and reset events for privileged accounts and investigate any changes not initiated by the account owner.

How to Mitigate CVE-2026-90460

Immediate Actions Required

Upgrade OpenStack Keystone to version 29.0.3 or later on all control-plane nodes.
Rotate any TOTP MFA seeds and credential secrets that could have been exposed to holders of delegated tokens.
Audit existing application credentials, EC2 credentials, OAuth1 access tokens, and trusts and revoke those not actively required.
Review Keystone audit logs for suspicious /v3/credentials activity dating back to when delegated authentication was enabled.

Patch Information

The fix is included in OpenStack Keystone 29.0.3. The upstream change is tracked at OpenDev Review #1002330. Operators running older Keystone series should apply the backported fix from their distribution vendor. Review Launchpad Bug #2158931 and Launchpad Bug #2159643 for patch scope and verification steps.

Workarounds

If immediate patching is not possible, restrict access to the /v3/credentials API at the network or reverse-proxy layer to trusted management hosts only.
Disable EC2 credential issuance where not required to eliminate the credential blob read path.
Reduce the lifetime of application credentials and trusts to shorten the exploitation window.

bash

# Upgrade Keystone via pip in a controlled environment
pip install --upgrade 'keystone>=29.0.3'

# Verify the installed Keystone version
keystone-manage --version

# Revoke a suspect application credential
openstack application credential delete <credential_id>