CVE-2026-44394
Fixed in a distro release EPSS <1%CVSS 6.0
An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone federated token rescoping mechanism does not propagate the original token's expiry to the newly issued token. When a federated user rescopes a token via POST /v3/auth/tokens, the handle_scoped_token() function in the mapped authentication plugin returns response data without an expires_at value. The token provider falls back to issuing a token with a fresh default TTL. By rescoping repeatedly before each token expires, a user can maintain access indefinitely, bypassing operator-configured token lifetime policies. This is a variant of CVE-2012-3426. Only deployments using federated identity (SAML2, OpenID Connect) are affected.
Products: OpenStack Keystone
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | keystone | 27.0.2 |
| PyPI | keystone | 28.0.2 |
| PyPI | keystone | 29.0.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | openstack-keystone-2025.1 | 27.0.1_git20260618-r6 |
| Chainguard | openstack-keystone-2025.1-fips | 27.0.1_git20260618-r7 |
| Chainguard | openstack-keystone-2025.2 | 28.0.1_git20260618-r5 |
| Chainguard | openstack-keystone-2025.2-fips | 28.0.1_git20260618-r5 |
| Chainguard | openstack-keystone-2026.1 | 29.0.1_git20260616-r6 |
| Chainguard | openstack-keystone-2026.1-fips | 29.0.1_git20260617-r6 |
| Debian 12 | keystone | 2:22.0.2-0+deb12u3 |
| Debian 13 | keystone | 2:27.0.0-3+deb13u4 |
| Debian 14 | keystone | 2:29.0.1-2 |
| Ubuntu 22.04 LTS | keystone | 2:21.0.1-0ubuntu2.4 |
| Ubuntu 24.04 LTS | keystone | 2:25.0.0-0ubuntu1.4 |
| Ubuntu 25.10 | keystone | 2:28.0.0-0ubuntu1.3 |
| Ubuntu 26.04 LTS | keystone | 2:29.0.0-0ubuntu1.2 |
| Ubuntu Pro 16.04 LTS | keystone | no fix |
| Ubuntu Pro 18.04 LTS | keystone | no fix |
| Ubuntu Pro 20.04 LTS | keystone | no fix |