Your message dated Sat, 17 Oct 2026 14:33:36 +0000
with message-id <[email protected]>
and subject line Bug#1149303: fixed in keystone 2:27.0.0-3+deb13u6
has caused the Debian Bug report #1149303,
regarding lp-2159643: Delegated tokens (like ec2credential,
application_credential, ...) can GET/PATCH/DELETE any credential including TOTP
seeds (CVE-2026-pending)
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1149303: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1149303
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: keystone
Version: 2:27.0.0-3+deb13u5
Severity: serious
Tags: security
X-Debbugs-Cc: [email protected], Debian Security Team
<[email protected]>
Copying launchpad.net bug from:
https://bugs.launchpad.net/keystone/+bug/2159643
Tokens obtained via delegated authentication methods (ec2credential,
application_credential) can call PATCH /v3/credentials and DELETE
/v3/credentials/{id} on any credential owned by the same user, regardless of
credential type.
This allows a holder of an ec2 access/secret key pair (or an application
credential) to:
• Overwrite a TOTP seed (type=totp) — immediately invalidates the user's
authenticator app and substitutes the attacker's seed, bypassing MFA
• Read credentials:
• ec2credential token can Read TOTP seed — full silent MFA compromise (as
well as any other credential blobs)
• application_credential token is correctly blocked from GET on individual
credentials (403), but can still list all ec2 credentials (one API call
dumps all credentials with their complete secrets)
• Change the project_id of any ec2 credential — re-scopes the credential to
any other project the user has roles in, escalating the access the key
provides. (A holder of an ec2 access/secret key pair can use the token
obtained from that key to change the project_id of that same credential,
re-scoping it to any other project the user has roles in.)
• Delete TOTP, SSH, or other credential types — credential wipe/DoS
• Create new credentials of any type via POST /v3/credentials (also unblocked
for ec2credential tokens — see bug 2153453 for the related CREATE gap)
Steps to reproduce (PATCH TOTP seed via ec2credential token):
1. User creates an ec2 credential and a TOTP credential
2. Attacker obtains the ec2 access/secret keys (e.g., from a shared server)
3. Attacker calls POST /v3/ec2tokens (via a service account) to obtain an
ec2credential token
4. Attacker calls PATCH /v3/credentials/{totp_cred_id} with the new TOTP seed
using that token → 200 OK
5. User's authenticator app is now invalid; attacker controls the MFA seed
Steps to reproduce (project_id scope escalation):
1. User has ec2 credential scoped to Project A (member), and also has admin
role in Project B
2. Attacker obtains the ec2 access/secret
3. Attacker gets ec2credential token, calls PATCH
/v3/credentials/{ec2_cred_id} with {"project_id": "<project_B_id>",
"blob": "..."}
4. Next ec2tokens call returns a token scoped to Project B with admin role
Root cause:
credentials.py patch() and delete() handlers have no guard against delegated
token methods. post() has a partial guard
(_check_unrestricted_application_credential) that bug 2153453 is extending,
but patch() and delete() have no equivalent. The _validate_blob_update_keys
guard only fires for existing ec2-type credentials and only validates blob key
stability, not the token method.
Proposed fix:
Add a _require_primary_auth guard to POST, PATCH, and DELETE in credentials.py
(and users.py OS-EC2 endpoint) that blocks any token whose methods list
contains no primary authentication method:
_PRIMARY_METHODS = frozenset({'password', 'totp', 'mapped', 'token'})
def _require_primary_auth_for_credential_write(token):
if not _PRIMARY_METHODS.intersection(token.methods):
raise exception.ForbiddenAction(
action=_("Modifying credentials requires primary "
"authentication (password, totp, or mapped).")
)
This covers ec2credential, application_credential, oauth1, and trust tokens by
default, and any future delegated method without needing per-type guards. It
also handles third-party custom credential types.
Note: This is the tip of the iceberg. EC2-derived tokens and application
credential tokens produce fully-privileged project-scoped Keystone tokens
usable against any OpenStack service API. Nova's keypair API (POST/DELETE
/v2/{project_id}/os-keypairs) has the same structural exposure — a stolen ec2
key can add attacker-controlled SSH keypairs to a project. This behavior is
undocumented -- one might assume that EC2 tokens work only on EC2/S3 APIs.
Nova and other services do not introspect token methods; enforcement there
would require a broader cross-project effort.
Note2: Type is a free-form string, no validation or whitelist. Any auth
plugin, integration, or third-party service can store credentials under
custom types. So any restrictions might interfere with legitimate, custom
usage.
Severity: High
Affects: All Keystone versions with ec2credentials enabled
Related: bug 2153453 (credential creation via delegated tokens), bug 2158970
(Adding/removing TOTP credentials requires no MFA re-auth)
--- End Message ---
--- Begin Message ---
Source: keystone
Source-Version: 2:27.0.0-3+deb13u6
Done: Thomas Goirand <[email protected]>
We believe that the bug you reported is fixed in the latest version of
keystone, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Thomas Goirand <[email protected]> (supplier of updated keystone package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Tue, 06 Oct 2026 20:06:28 +0200
Source: keystone
Architecture: source
Version: 2:27.0.0-3+deb13u6
Distribution: trixie-security
Urgency: medium
Maintainer: Debian OpenStack <[email protected]>
Changed-By: Thomas Goirand <[email protected]>
Closes: 1149303 1149956
Changes:
keystone (2:27.0.0-3+deb13u6) trixie-security; urgency=medium
.
* CVE-2026-90460: Delegated tokens (like ec2credential,
application_credential, ...) can GET/PATCH/DELETE any credential including
TOTP seeds. Delegation project boundary not enforced on PATCH
/v3/credentials/{id}. Applied upstream patch: "credentials: reject
delegated tokens, restrict PATCH to blob only" (Closes: #1149303,
#1149956):
- CVE-2026-90460_lp-2159643_credentials_reject_delegated-tokens_re....patch
Checksums-Sha1:
09fd88588cc9be231326b8154bdadf9b23aaed84 3486 keystone_27.0.0-3+deb13u6.dsc
896a6f57c727fa62d0aec10d5c8844b40cc42bdb 1098444 keystone_27.0.0.orig.tar.xz
b56b31fc7f1763a4e22ad1f3f0c5e6e4c7daa68e 89448
keystone_27.0.0-3+deb13u6.debian.tar.xz
8a49c1280ba3644a044f8e16894b4a4bc6f9ed07 18938
keystone_27.0.0-3+deb13u6_amd64.buildinfo
Checksums-Sha256:
d8dad5550b5254809599adfb16330f07d124d9b92e5fa6ab28ab4602fb6a9ec7 3486
keystone_27.0.0-3+deb13u6.dsc
223b27dc676dabd6c9d67e4409fe086f92b5d47bf71ee8c724c3e0d13f26d635 1098444
keystone_27.0.0.orig.tar.xz
21a3dfd8904cf1616ed16a89c9f3e6daac6d287a7e17527c882298474eaf60c7 89448
keystone_27.0.0-3+deb13u6.debian.tar.xz
99a44ba2dba5b08f78fb8260abbb9a26ff8dbe81212e9f0738fb6f1448941b0b 18938
keystone_27.0.0-3+deb13u6_amd64.buildinfo
Files:
c3398356872e13542e0df92267c52f48 3486 net optional
keystone_27.0.0-3+deb13u6.dsc
d8119041a4ba1c4545ab5dabe9ae65b9 1098444 net optional
keystone_27.0.0.orig.tar.xz
d1af659b458b6f88b5ae55ad68ed56da 89448 net optional
keystone_27.0.0-3+deb13u6.debian.tar.xz
5a75b199114e065670506b0b3f364a10 18938 net optional
keystone_27.0.0-3+deb13u6_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmrKDOEACgkQ1BatFaxr
Q/4zEBAAiTJpD6hJ4+9SptNDHk/6lr+kXoDO3634jbHEYVqUYh//O2SWNcKXM0ze
VN2NL2A76UC5uIlynSXa6jAoy7GJYNwTp4t0NX8be4HgINeaGrj+t+Z0swEmoAAZ
ptWCDmgLfahdq0zRgUDicJPT29cib60SoBPSTRgc1MOm4niChYA27mgw6uaLcrrT
n1u1NNXg60mx5Hgt8HChasac32Om/fzeqi1O/JoK4QfCyeglB8aIWZ7dZWUyvvAA
9FZsPE0rVnnYu16Aa3B8v/rMV7JZJ+8CU2gCn+dKNdelGyAzR30p4tM9UL5T+Ku4
TXkgRnUqvFtQbFN4G4mh2RSCZyJqhGH3E5jlqrwZIoMmBdtt7COv2RxXwaIkaKiC
tAWGGbHM8n8oF/8tvN9RukMoMALdlCqsiNZ5sX/BGr7MTxsjeojPlIbOsSwjQKSm
N+MeuELXJVNdeo9CZoiaR3uOxfenTx4/hBPIli2kj3iAcSf7hCDR2V/He4NGlDUX
KLAZsnm8I0LKY85PXMK6JAf6KCY2iR872m8se5WpjkUmnaykkBWBjci4v5ibsfk/
D3ApkPVa5UeXrgIV7Y1OzmDu4WhrzgGJifAIkhunbFneA78Ym7N2q0f/nfqXXjGw
blZz99ysALPx8vvC1wcwyUAYq0f75JbsXFlVslO8zuqnmU3EdlA=
=y9oi
-----END PGP SIGNATURE-----
pgpbfiGP3ggD0.pgp
Description: PGP signature
--- End Message ---
