CVE-2026-90460
An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods (EC2 credentials, application credentials, OAuth1 access tokens, and trusts) are not blocked from creating, modifying, or deleting credentials via the /v3/credentials API. EC2-derived tokens can additionally read credential blobs, exposing TOTP MFA seeds and other secrets. Also, PATCH /v3/credentials does not validate the requested post-update project_id, allowing any delegated token to move a credential to an unauthorized project. All Keystone deployments using delegated authentication are affected.
CVE-2026-90460
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-90460
Keystone
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://opendev.org/openstack/keystone",
"vendor": "OpenStack",
"product": "Keystone",
"versions": [
{
"status": "affected",
"version": "13.0.0",
"lessThan": "27.0.3",
"versionType": "semver"
},
{
"status": "affected",
"version": "28.0.0",
"lessThan": "28.0.3",
"versionType": "semver"
},
{
"status": "affected",
"version": "29.0.0",
"lessThan": "29.0.3",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-90460
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #20373 · Revision 1
- Added to Heist Feed
- Publisher date