PatchSiren cyber security CVE debrief
CVE-2026-44394 OpenStack CVE debrief
A vulnerability in OpenStack Keystone before 29.0.2 allows federated identity users to bypass token expiration policies through repeated token rescoping. When a federated user rescopes a token via POST /v3/auth/tokens, the handle_scoped_token() function in the mapped authentication plugin fails to propagate the original token's expires_at value to the new token. The token provider then issues a replacement with a fresh default TTL. By rescoping before each token expires, a user can maintain indefinite access. Only deployments using federated identity (SAML2, OpenID Connect) are affected. This issue is a variant of CVE-2012-3426.
- Vendor
- OpenStack
- Product
- Keystone
- CVSS
- MEDIUM 6
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-28
- Original CVE updated
- 2026-05-29
- Advisory published
- 2026-05-28
- Advisory updated
- 2026-05-29
Who should care
OpenStack cloud operators using federated identity (SAML2 or OpenID Connect); security teams managing identity lifecycle policies; compliance auditors verifying access control enforcement
Technical summary
The mapped authentication plugin's handle_scoped_token() function returns response data without an expires_at value during federated token rescoping. The token provider falls back to default TTL instead of preserving the original token's remaining lifetime. This allows repeated rescoping to reset token expiration indefinitely.
Defensive priority
HIGH
Recommended defensive actions
- Upgrade OpenStack Keystone to version 29.0.2 or later
- Review and audit federated identity token lifetimes in deployment configurations
- Implement monitoring for anomalous token rescoping frequency from federated users
- Apply principle of least privilege to federated identity mappings to reduce blast radius
- Review logs for historical patterns of excessive token rescoping that may indicate exploitation
- Consider implementing additional token lifetime enforcement at the identity provider level for federated authentication
Evidence notes
The vulnerability description is sourced from the official CVE record published 2026-05-28. Affected versions are explicitly stated as before 29.0.2. The attack vector requires authenticated federated identity access and repeated API calls to the token rescoping endpoint. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L) reflects network attack vector, high attack complexity, low privileges required, no user interaction, changed scope, and low impacts across confidentiality, integrity, and availability.
Official resources
2026-05-28