CVE-2026-90460 OpenStack CVE debrief

Who should care

OpenStack administrators and security teams should assess exposure and prioritize remediation for Keystone deployments using delegated authentication. This includes verifying affected versions, reviewing Keystone configurations, and restricting credential management API access for delegated authentication tokens. Security teams should also monitor and limit the use of delegated authentication methods and review compensating controls for exposed systems.

Why it matters

CVE-2026-90460 is a high-severity vulnerability in OpenStack Keystone that allows delegated authentication tokens to manage credentials, potentially exposing sensitive information. Defenders should prioritize verifying and restricting credential management API access, review and update OpenStack Keystone, and monitor delegated authentication method usage.

• Credential exposure and unauthorized access to sensitive information
• Potential for lateral movement and escalation of privileges
• Need for verification of affected versions and deployments
• Priority for updating OpenStack Keystone to version 29.0.3 or later

Technical summary

Tokens obtained via delegated authentication methods in OpenStack Keystone can be used to create, modify, or delete credentials, potentially exposing sensitive information such as TOTP MFA seeds. This vulnerability affects Keystone deployments using delegated authentication methods, including EC2 credentials, application credentials, OAuth1 access tokens, and trusts. The lack of validation for the requested post-update project_id in PATCH /v3/credentials allows any delegated token to move a credential to an unauthorized project.

Defensive priority

Defenders should prioritize verifying and restricting credential management API access for delegated authentication tokens, especially in OpenStack Keystone deployments.

Recommended defensive actions

• Verify and restrict credential management API access for delegated authentication tokens in OpenStack Keystone deployments.
• Review and update OpenStack Keystone to version 29.0.3 or later.
• Monitor and limit the use of delegated authentication methods.
• Confirm whether affected Keystone deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in OpenStack Keystone. However, the exact scope of affected versions and deployments requires further verification. OpenStack administrators should verify affected versions, review Keystone configurations, and assess exposure to delegated authentication methods. Evidence from the CVE record and NVD entry suggests that defenders should prioritize verifying and restricting credential management API access.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.