Control: tag -1 pending Hello,
Bug #1149956 in keystone reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/keystone/-/commit/d3ea766dee7bd1bf6738e0745f81c5f66883d222 ------------------------------------------------------------------------ * CVE-2026-90460: Delegated tokens (like ec2credential, application_credential, ...) can GET/PATCH/DELETE any credential including TOTP seeds. Delegation project boundary not enforced on PATCH /v3/credentials/{id}. This was due to an incomplete fix for OSSA-2026-015. Applied upstream patch: "credentials: reject delegated tokens, restrict PATCH to blob only" (Closes: #1149303, #1149956): - CVE-2026-90460_lp-2159643_credentials_reject_delegated-tokens_re....patch * OSSN-0109: identity, credentials: require MFA re-verification for sensitive actions: - OSSN-0109_lp-2157347_invalidate_MFA_auth_receipts_and_TOTP_passco....patch (Closes: #1149305) - OSSN-0109_lp-2158970_identity_credentials_require_MFA_re-verifica....patch (Closes: #1149304) ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1149956
