CVE-2026-90460
Publication date 11 September 2026
Last updated 9 November 2026
Ubuntu priority
Description
An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods (EC2 credentials, application credentials, OAuth1 access tokens, and trusts) are not blocked from creating, modifying, or deleting credentials via the /v3/credentials API. EC2-derived tokens can additionally read credential blobs, exposing TOTP MFA seeds and other secrets. Also, PATCH /v3/credentials does not validate the requested post-update project_id, allowing any delegated token to move a credential to an unauthorized project. All Keystone deployments using delegated authentication are affected.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| keystone | 26.10 stonking |
Vulnerable, fix deferred
|
| 26.04 LTS resolute |
Vulnerable, fix deferred
|
|
| 24.04 LTS noble |
Vulnerable, fix deferred
|
|
| 22.04 LTS jammy |
Vulnerable, fix deferred
|
|
| 20.04 LTS focal |
Vulnerable, fix deferred
|
|
| 18.04 LTS bionic |
Vulnerable, fix deferred
|
|
| 16.04 LTS xenial |
Vulnerable, fix deferred
|
Notes
mdeslaur
As of 2026-11-09, the fix appears to be incomplete, and the WIP OSSN-0111 linked in the bug was used for another issue.
Severity score breakdown
CVSS version: CVSS v4.0
Base score
7.6 · High
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N