Your message dated Sat, 17 Oct 2026 14:33:36 +0000
with message-id <[email protected]>
and subject line Bug#1149303: fixed in keystone 2:27.0.0-3+deb13u6
has caused the Debian Bug report #1149303,
regarding keystone: CVE-2026-90460
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1149303: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1149303
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: keystone
Version: 2:27.0.0-3
X-Debbugs-CC: [email protected]
Severity: important
Tags: security upstream
Hi,
The following vulnerability was published for keystone.
CVE-2026-90460[0]:
| An issue was discovered in OpenStack Keystone before 29.0.3. Tokens
| obtained via delegated authentication methods (EC2 credentials,
| application credentials, OAuth1 access tokens, and trusts) are not
| blocked from creating, modifying, or deleting credentials via the
| /v3/credentials API. EC2-derived tokens can additionally read
| credential blobs, exposing TOTP MFA seeds and other secrets. Also,
| PATCH /v3/credentials does not validate the requested post-update
| project_id, allowing any delegated token to move a credential to an
| unauthorized project. All Keystone deployments using delegated
| authentication are affected.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-90460
https://www.cve.org/CVERecord?id=CVE-2026-90460
[1] https://bugs.launchpad.net/keystone/+bug/2159643
[2] https://bugs.launchpad.net/keystone/+bug/2158931
[3] https://review.opendev.org/c/openstack/keystone/+/1002330
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: keystone
Source-Version: 2:27.0.0-3+deb13u6
Done: Thomas Goirand <[email protected]>
We believe that the bug you reported is fixed in the latest version of
keystone, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Thomas Goirand <[email protected]> (supplier of updated keystone package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Tue, 06 Oct 2026 20:06:28 +0200
Source: keystone
Architecture: source
Version: 2:27.0.0-3+deb13u6
Distribution: trixie-security
Urgency: medium
Maintainer: Debian OpenStack <[email protected]>
Changed-By: Thomas Goirand <[email protected]>
Closes: 1149303 1149956
Changes:
keystone (2:27.0.0-3+deb13u6) trixie-security; urgency=medium
.
* CVE-2026-90460: Delegated tokens (like ec2credential,
application_credential, ...) can GET/PATCH/DELETE any credential including
TOTP seeds. Delegation project boundary not enforced on PATCH
/v3/credentials/{id}. Applied upstream patch: "credentials: reject
delegated tokens, restrict PATCH to blob only" (Closes: #1149303,
#1149956):
- CVE-2026-90460_lp-2159643_credentials_reject_delegated-tokens_re....patch
Checksums-Sha1:
09fd88588cc9be231326b8154bdadf9b23aaed84 3486 keystone_27.0.0-3+deb13u6.dsc
896a6f57c727fa62d0aec10d5c8844b40cc42bdb 1098444 keystone_27.0.0.orig.tar.xz
b56b31fc7f1763a4e22ad1f3f0c5e6e4c7daa68e 89448
keystone_27.0.0-3+deb13u6.debian.tar.xz
8a49c1280ba3644a044f8e16894b4a4bc6f9ed07 18938
keystone_27.0.0-3+deb13u6_amd64.buildinfo
Checksums-Sha256:
d8dad5550b5254809599adfb16330f07d124d9b92e5fa6ab28ab4602fb6a9ec7 3486
keystone_27.0.0-3+deb13u6.dsc
223b27dc676dabd6c9d67e4409fe086f92b5d47bf71ee8c724c3e0d13f26d635 1098444
keystone_27.0.0.orig.tar.xz
21a3dfd8904cf1616ed16a89c9f3e6daac6d287a7e17527c882298474eaf60c7 89448
keystone_27.0.0-3+deb13u6.debian.tar.xz
99a44ba2dba5b08f78fb8260abbb9a26ff8dbe81212e9f0738fb6f1448941b0b 18938
keystone_27.0.0-3+deb13u6_amd64.buildinfo
Files:
c3398356872e13542e0df92267c52f48 3486 net optional
keystone_27.0.0-3+deb13u6.dsc
d8119041a4ba1c4545ab5dabe9ae65b9 1098444 net optional
keystone_27.0.0.orig.tar.xz
d1af659b458b6f88b5ae55ad68ed56da 89448 net optional
keystone_27.0.0-3+deb13u6.debian.tar.xz
5a75b199114e065670506b0b3f364a10 18938 net optional
keystone_27.0.0-3+deb13u6_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmrKDOEACgkQ1BatFaxr
Q/4zEBAAiTJpD6hJ4+9SptNDHk/6lr+kXoDO3634jbHEYVqUYh//O2SWNcKXM0ze
VN2NL2A76UC5uIlynSXa6jAoy7GJYNwTp4t0NX8be4HgINeaGrj+t+Z0swEmoAAZ
ptWCDmgLfahdq0zRgUDicJPT29cib60SoBPSTRgc1MOm4niChYA27mgw6uaLcrrT
n1u1NNXg60mx5Hgt8HChasac32Om/fzeqi1O/JoK4QfCyeglB8aIWZ7dZWUyvvAA
9FZsPE0rVnnYu16Aa3B8v/rMV7JZJ+8CU2gCn+dKNdelGyAzR30p4tM9UL5T+Ku4
TXkgRnUqvFtQbFN4G4mh2RSCZyJqhGH3E5jlqrwZIoMmBdtt7COv2RxXwaIkaKiC
tAWGGbHM8n8oF/8tvN9RukMoMALdlCqsiNZ5sX/BGr7MTxsjeojPlIbOsSwjQKSm
N+MeuELXJVNdeo9CZoiaR3uOxfenTx4/hBPIli2kj3iAcSf7hCDR2V/He4NGlDUX
KLAZsnm8I0LKY85PXMK6JAf6KCY2iR872m8se5WpjkUmnaykkBWBjci4v5ibsfk/
D3ApkPVa5UeXrgIV7Y1OzmDu4WhrzgGJifAIkhunbFneA78Ym7N2q0f/nfqXXjGw
blZz99ysALPx8vvC1wcwyUAYq0f75JbsXFlVslO8zuqnmU3EdlA=
=y9oi
-----END PGP SIGNATURE-----
pgpp8_lgiISpc.pgp
Description: PGP signature
--- End Message ---
