[Security Advisory][keystone] CVE-2026-pending Launchpad bug 2153453 and 2158538

Aug. 25, 2026

      Hi Yaook users,

OpenStack published CVEs for keystone.

Grzegorz Grasza (Red Hat) and Tim Shephard (roiai.ca) independently 
identified that OpenStack Keystone does not consistently enforce scope 
restrictions on tokens obtained via
delegated authentication methods (ec2credential, application credential, 
OAuth1 access tokens). The underlying issue is the same: delegated 
tokens can perform operations or reach projects beyond their intended 
scope. Two separate CVEs have been requested for distinct attack vectors 
that share this root cause.

Delegation bypass in trust, OAuth1, and application credential 
operations (CVE-2026-pending, LP#2153453):
Tokens obtained via EC2 credential authentication can create new 
application credentials and authorize OAuth1 request tokens, 
bootstrapping new delegations that persist independently of the original 
credential and survive its revocation. Both EC2 and OAuth1 tokens can 
create trusts that delegate roles beyond the requesting token’s scope, 
because trust role validation checks the trustor’s full role assignments 
rather than the token’s scoped roles.

Token reauthentication escape (CVE-2026-pending, LP#2158538):
Tokens obtained via application credential or EC2 credential 
authentication can escape their intended project scope through 
token-method reauthentication. An application-credential token scoped to 
one project can be exchanged via POST /v3/auth/tokens with no explicit 
scope, causing Keystone to issue a new token scoped to the owner’s 
default project. For EC2-derived tokens the bypass is broader: because 
they carry no delegation markers, they can rescope to any project where 
the underlying user has role assignments.

The following images are vulnerable:

  * keystone images before 3.0.94
  * yaook release before 3.4.0

If this image is used in your cluster for the keystone deployment, the 
cluster is vulnerable.

The fixed image has been built in a private pipeline[2] which has been 
published alongside this advisory[1] to prove the image provenance.

We recommend to add a YAOOK_OP_VERSIONS_OVERRIDE[3] variable to your 
keystone operator container to pull the image before the YAOOK 
comprehensive release is ready.

|operator: extraEnv: - name: YAOOK_OP_VERSIONS_OVERRIDE value: | { 
"registry.yaook.cloud/yaook/keystone-2024.1": 
"registry.yaook.cloud/yaook/keystone-2024.1:3.0.94", 
"registry.yaook.cloud/yaook/keystone-2024.2": 
"registry.yaook.cloud/yaook/keystone-2024.2:3.0.94", 
"registry.yaook.cloud/yaook/keystone-2025.1": 
"registry.yaook.cloud/yaook/keystone-2025.1:3.0.94", 
"registry.yaook.cloud/yaook/keystone-2025.2": 
"registry.yaook.cloud/yaook/keystone-2025.2:3.0.94", 
"registry.yaook.cloud/yaook/keystone-2026.1": 
"registry.yaook.cloud/yaook/keystone-2026.1:3.0.94" }|

More info can be found in our security advisory[1].

Regards
Stefan

[1] https://yaook.cloud/security-advisories-ossa-2026-037/
[2] https://gitlab.com/yaook-security/images/keystone/-/pipelines/2789490776
[3] 
https://docs.yaook.cloud/user/references/env-reference.html#envvar-YAOOK_OP_...

-- 
Stefan Hoffmann
DevOps Engineer

Cloud&Heat Technologies GmbH
Königsbrücker Straße 96 | 01099 Dresden
+49 351 479 367 36
stefan.hoffmann@cloudandheat.com |www.cloudandheat.com

Green, Open, Efficient.
Ihr Cloud-Service- und Cloud-Technologie-Provider aus Dresden.
https://www.cloudandheat.com/

Commercial Register: District Court Dresden
Register Number: HRB 30549
VAT ID No.: DE281093504
Managing Director: Nicolas Röhrs
Authorized signatory: Dr. Marius Feldmann

Stefan Hoffmann

Stefan Hoffmann

tags

participants (1)