August 2026 - Yaook - lists.alasca.cloud

Re: [Security Advisory][keystone] CVE-2026-pending Launchpad bug 2153453 and 2158538

by Stefan Hoffmann

Hint: The today published Yaook release (3.3.1) does not have the fixes included. So the override is still needed. On 8/25/26 17:35, Stefan Hoffmann via Announce wrote: > > Hi Yaook users, > > OpenStack published CVEs for keystone. > > Grzegorz Grasza (Red Hat) and Tim Shephard (roiai.ca) independently > identified that OpenStack Keystone does not consistently enforce scope > restrictions on tokens obtained via > delegated authentication methods (ec2credential, application > credential, OAuth1 access tokens). The underlying issue is the same: > delegated tokens can perform operations or reach projects beyond their > intended scope. Two separate CVEs have been requested for distinct > attack vectors that share this root cause. > > Delegation bypass in trust, OAuth1, and application credential > operations (CVE-2026-pending, LP#2153453): > Tokens obtained via EC2 credential authentication can create new > application credentials and authorize OAuth1 request tokens, > bootstrapping new delegations that persist independently of the > original credential and survive its revocation. Both EC2 and OAuth1 > tokens can create trusts that delegate roles beyond the requesting > token’s scope, because trust role validation checks the trustor’s full > role assignments rather than the token’s scoped roles. > > Token reauthentication escape (CVE-2026-pending, LP#2158538): > Tokens obtained via application credential or EC2 credential > authentication can escape their intended project scope through > token-method reauthentication. An application-credential token scoped > to one project can be exchanged via POST /v3/auth/tokens with no > explicit scope, causing Keystone to issue a new token scoped to the > owner’s default project. For EC2-derived tokens the bypass is broader: > because they carry no delegation markers, they can rescope to any > project where the underlying user has role assignments. > > The following images are vulnerable: > > * keystone images before 3.0.94 > * yaook release before 3.4.0 > > If this image is used in your cluster for the keystone deployment, the > cluster is vulnerable. > > The fixed image has been built in a private pipeline[2] which has been > published alongside this advisory[1] to prove the image provenance. > > We recommend to add a YAOOK_OP_VERSIONS_OVERRIDE[3] variable to your > keystone operator container to pull the image before the YAOOK > comprehensive release is ready. > > |operator: extraEnv: - name: YAOOK_OP_VERSIONS_OVERRIDE value: | { > "registry.yaook.cloud/yaook/keystone-2024.1": > "registry.yaook.cloud/yaook/keystone-2024.1:3.0.94", > "registry.yaook.cloud/yaook/keystone-2024.2": > "registry.yaook.cloud/yaook/keystone-2024.2:3.0.94", > "registry.yaook.cloud/yaook/keystone-2025.1": > "registry.yaook.cloud/yaook/keystone-2025.1:3.0.94", > "registry.yaook.cloud/yaook/keystone-2025.2": > "registry.yaook.cloud/yaook/keystone-2025.2:3.0.94", > "registry.yaook.cloud/yaook/keystone-2026.1": > "registry.yaook.cloud/yaook/keystone-2026.1:3.0.94" }| > > More info can be found in our security advisory[1]. > > Regards > Stefan > > > [1] https://yaook.cloud/security-advisories-ossa-2026-037/ > [2] > https://gitlab.com/yaook-security/images/keystone/-/pipelines/2789490776 > [3] > https://docs.yaook.cloud/user/references/env-reference.html#envvar-YAOOK_OP… > > > > -- > Stefan Hoffmann > DevOps Engineer > > Cloud&Heat Technologies GmbH > Königsbrücker Straße 96 | 01099 Dresden > +49 351 479 367 36 > stefan.hoffmann(a)cloudandheat.com |www.cloudandheat.com > > Green, Open, Efficient. > Ihr Cloud-Service- und Cloud-Technologie-Provider aus Dresden. > https://www.cloudandheat.com/ > > Commercial Register: District Court Dresden > Register Number: HRB 30549 > VAT ID No.: DE281093504 > Managing Director: Nicolas Röhrs > Authorized signatory: Dr. Marius Feldmann > > _______________________________________________ > Announce mailing list --announce(a)lists.alasca.cloud > To unsubscribe send an email toannounce-leave(a)lists.alasca.cloud -- Stefan Hoffmann DevOps Engineer Cloud&Heat Technologies GmbH Königsbrücker Straße 96 | 01099 Dresden +49 351 479 367 36 stefan.hoffmann(a)cloudandheat.com |www.cloudandheat.com Green, Open, Efficient. Ihr Cloud-Service- und Cloud-Technologie-Provider aus Dresden. https://www.cloudandheat.com/ Commercial Register: District Court Dresden Register Number: HRB 30549 VAT ID No.: DE281093504 Managing Director: Nicolas Röhrs Authorized signatory: Dr. Marius Feldmann

Aug. 27, 2026

[Security Advisory][keystone] CVE-2026-pending Launchpad bug 2153453 and 2158538

by Stefan Hoffmann

Hi Yaook users, OpenStack published CVEs for keystone. Grzegorz Grasza (Red Hat) and Tim Shephard (roiai.ca) independently identified that OpenStack Keystone does not consistently enforce scope restrictions on tokens obtained via delegated authentication methods (ec2credential, application credential, OAuth1 access tokens). The underlying issue is the same: delegated tokens can perform operations or reach projects beyond their intended scope. Two separate CVEs have been requested for distinct attack vectors that share this root cause. Delegation bypass in trust, OAuth1, and application credential operations (CVE-2026-pending, LP#2153453): Tokens obtained via EC2 credential authentication can create new application credentials and authorize OAuth1 request tokens, bootstrapping new delegations that persist independently of the original credential and survive its revocation. Both EC2 and OAuth1 tokens can create trusts that delegate roles beyond the requesting token’s scope, because trust role validation checks the trustor’s full role assignments rather than the token’s scoped roles. Token reauthentication escape (CVE-2026-pending, LP#2158538): Tokens obtained via application credential or EC2 credential authentication can escape their intended project scope through token-method reauthentication. An application-credential token scoped to one project can be exchanged via POST /v3/auth/tokens with no explicit scope, causing Keystone to issue a new token scoped to the owner’s default project. For EC2-derived tokens the bypass is broader: because they carry no delegation markers, they can rescope to any project where the underlying user has role assignments. The following images are vulnerable: * keystone images before 3.0.94 * yaook release before 3.4.0 If this image is used in your cluster for the keystone deployment, the cluster is vulnerable. The fixed image has been built in a private pipeline[2] which has been published alongside this advisory[1] to prove the image provenance. We recommend to add a YAOOK_OP_VERSIONS_OVERRIDE[3] variable to your keystone operator container to pull the image before the YAOOK comprehensive release is ready. |operator: extraEnv: - name: YAOOK_OP_VERSIONS_OVERRIDE value: | { "registry.yaook.cloud/yaook/keystone-2024.1": "registry.yaook.cloud/yaook/keystone-2024.1:3.0.94", "registry.yaook.cloud/yaook/keystone-2024.2": "registry.yaook.cloud/yaook/keystone-2024.2:3.0.94", "registry.yaook.cloud/yaook/keystone-2025.1": "registry.yaook.cloud/yaook/keystone-2025.1:3.0.94", "registry.yaook.cloud/yaook/keystone-2025.2": "registry.yaook.cloud/yaook/keystone-2025.2:3.0.94", "registry.yaook.cloud/yaook/keystone-2026.1": "registry.yaook.cloud/yaook/keystone-2026.1:3.0.94" }| More info can be found in our security advisory[1]. Regards Stefan [1] https://yaook.cloud/security-advisories-ossa-2026-037/ [2] https://gitlab.com/yaook-security/images/keystone/-/pipelines/2789490776 [3] https://docs.yaook.cloud/user/references/env-reference.html#envvar-YAOOK_OP… -- Stefan Hoffmann DevOps Engineer Cloud&Heat Technologies GmbH Königsbrücker Straße 96 | 01099 Dresden +49 351 479 367 36 stefan.hoffmann(a)cloudandheat.com |www.cloudandheat.com Green, Open, Efficient. Ihr Cloud-Service- und Cloud-Technologie-Provider aus Dresden. https://www.cloudandheat.com/ Commercial Register: District Court Dresden Register Number: HRB 30549 VAT ID No.: DE281093504 Managing Director: Nicolas Röhrs Authorized signatory: Dr. Marius Feldmann

Aug. 25, 2026

[DEPRECATION] OpenStack support for 2024.1 / caracal at yaook

by Stefan Hoffmann

Hi yaook-users, we would like to remove support for OpenStack version 2024.1/caracal soon. If you have any concerns or still use this version, please comment to https://gitlab.com/yaook/operator/-/work_items/692 Best regards Stefan -- Stefan Hoffmann DevOps Engineer Cloud&Heat Technologies GmbH Königsbrücker Straße 96 | 01099 Dresden +49 351 479 367 36 stefan.hoffmann(a)cloudandheat.com | www.cloudandheat.com Green, Open, Efficient. Ihr Cloud-Service- und Cloud-Technologie-Provider aus Dresden. https://www.cloudandheat.com/ Commercial Register: District Court Dresden Register Number: HRB 30549 VAT ID No.: DE281093504 Managing Director: Nicolas Röhrs Authorized signatory: Dr. Marius Feldmann

Aug. 14, 2026

[Security Advisory][designate] CVE-2026-71193 and CVE-2026-71194

by Stefan Hoffmann

Hi Yaook users, OpenStack published two CVEs for designate. One is a vulnerability in OpenStack Designate zone scheduling. An authenticated tenant can bypass zone ownership checks by scheduling a zone to a different pool, creating overlapping zones that hijack or deny service to another tenant's DNS records. Any user with the default create_zone policy can exploit this when the AttributeFilter scheduler is enabled. Only deployments using the AttributeFilter scheduler with multiple pools are affected. The other CVE is a related vulnerability in the Designate mDNS handler during triage. The mDNS handler performs pool-blind record lookups that fail when colliding zones exist across pools, causing deterministic DNS query failures. The NOTIFY handler path is reachable via unauthenticated UDP. The following images are vulnerable: * designate images before 1.0.29 * yaook release before 3.3.0 If this image is used in your cluster for the designate deployment, the cluster is vulnerable. The fixed image has been built in a private pipeline[2] which has been published alongside the advisory[1] to prove the image provenance. We recommend to add a YAOOK_OP_VERSIONS_OVERRIDE[3] variable to your Designate operator container to pull the image before the YAOOK comprehensive release is ready. |operator: extraEnv: - name: YAOOK_OP_VERSIONS_OVERRIDE value: | { "registry.yaook.cloud/yaook/designate-2024.1": "registry.yaook.cloud/yaook/designate-2024.1:1.0.29", "registry.yaook.cloud/yaook/designate-2024.2": "registry.yaook.cloud/yaook/designate-2024.2:1.0.29", "registry.yaook.cloud/yaook/designate-2025.1": "registry.yaook.cloud/yaook/designate-2025.1:1.0.29", "registry.yaook.cloud/yaook/designate-2025.2": "registry.yaook.cloud/yaook/designate-2025.2:1.0.29", "registry.yaook.cloud/yaook/designate-2026.1": "registry.yaook.cloud/yaook/designate-2026.1:1.0.29" }| More info can be found in our security advisory[1]. Regards Stefan [1] https://yaook.cloud/security-advisories-cve-2026-71193-71194/ [2] https://gitlab.com/yaook-security/images/designate/-/pipelines/2746847469 [3] https://docs.yaook.cloud/user/references/env-reference.html#envvar-YAOOK_OP… -- Stefan Hoffmann DevOps Engineer Cloud&Heat Technologies GmbH Königsbrücker Straße 96 | 01099 Dresden +49 351 479 367 36 stefan.hoffmann(a)cloudandheat.com |www.cloudandheat.com Green, Open, Efficient. Ihr Cloud-Service- und Cloud-Technologie-Provider aus Dresden. https://www.cloudandheat.com/ Commercial Register: District Court Dresden Register Number: HRB 30549 VAT ID No.: DE281093504 Managing Director: Nicolas Röhrs Authorized signatory: Dr. Marius Feldmann

Aug. 11, 2026