OpenStack Keystone up to 27.0.2/28.0.2/29.0.2 Credentials API project_id privileges management

Summaryinfo

A vulnerability was found in OpenStack Keystone up to 27.0.2/28.0.2/29.0.2. It has been rated as critical. Affected by this issue is some unknown functionality of the component Credentials API. The manipulation of the argument project_id leads to privileges management. This vulnerability is traded as CVE-2026-90460. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as critical, has been found in OpenStack Keystone up to 27.0.2/28.0.2/29.0.2. This issue affects an unknown function of the component Credentials API. The manipulation of the argument project_id with an unknown input leads to a privileges management vulnerability. Using CWE to declare the problem leads to CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods (EC2 credentials, application credentials, OAuth1 access tokens, and trusts) are not blocked from creating, modifying, or deleting credentials via the /v3/credentials API. EC2-derived tokens can additionally read credential blobs, exposing TOTP MFA seeds and other secrets. Also, PATCH /v3/credentials does not validate the requested post-update project_id, allowing any delegated token to move a credential to an unauthorized project. All Keystone deployments using delegated authentication are affected.

The advisory is shared at launchpad.net. The identification of this vulnerability is CVE-2026-90460 since 09/11/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1068 for this issue.

Upgrading to version 27.0.3, 28.0.3 or 29.0.3 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Cloud Software

Vendor

• OpenStack

Name

• Keystone

Version

• 27.0.0
• 27.0.1
• 27.0.2
• 28.0.0
• 28.0.1
• 28.0.2
• 29.0.0
• 29.0.1
• 29.0.2

License

• free

Website

• Vendor: https://www.openstack.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion