Source: keystone Version: 2:27.0.0-3 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream
Hi, The following vulnerability was published for keystone. CVE-2026-90460[0]: | An issue was discovered in OpenStack Keystone before 29.0.3. Tokens | obtained via delegated authentication methods (EC2 credentials, | application credentials, OAuth1 access tokens, and trusts) are not | blocked from creating, modifying, or deleting credentials via the | /v3/credentials API. EC2-derived tokens can additionally read | credential blobs, exposing TOTP MFA seeds and other secrets. Also, | PATCH /v3/credentials does not validate the requested post-update | project_id, allowing any delegated token to move a credential to an | unauthorized project. All Keystone deployments using delegated | authentication are affected. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-90460 https://www.cve.org/CVERecord?id=CVE-2026-90460 [1] https://bugs.launchpad.net/keystone/+bug/2159643 [2] https://bugs.launchpad.net/keystone/+bug/2158931 [3] https://review.opendev.org/c/openstack/keystone/+/1002330 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
