CVE-2026-90460

OpenStack Keystone before 29.0.3 fails to enforce authorization (CWE-863) on the /v3/credentials API for tokens issued via delegated authentication methods, including EC2 credentials, application credentials, OAuth1 access tokens, and trusts. An attacker who obtains such a delegated token can create, modify, or delete credentials through the API. EC2-derived tokens can additionally read full credential blobs, exposing secrets such as TOTP MFA seeds, and PATCH /v3/credentials does not validate the requested post-update project_id, so a delegated token can move any credential into an unauthorized project. All Keystone deployments that use delegated authentication are affected. No public proof-of-concept is known, the issue is not in CISA KEV, and exploitation has not been reported.

What to do: Upgrade Keystone to 29.0.3 or later. As interim mitigation, limit issuance and scope of delegated tokens (application credentials, EC2 credentials, OAuth1, trusts) and restrict access to /v3/credentials. Review credential-API audit logs for create/modify/delete operations performed with delegated tokens, check for credentials moved to unexpected projects, and rotate exposed secrets such as TOTP MFA seeds and application credentials if tampering is found.