Key Considerations for Ubuntu OpenStack Keystone Auth Issues USN-8854

Running self-managed GitLab? Critical flaws could allow server code execution. Check the fixes. ×

Several security issues were fixed in OpenStack Keystone. Software Description: - keystone: OpenStack identity service Details: Grzegorz Grasza discovered that OpenStack Keystone did not consistently enforce restrictions for delegated authentication tokens. An authenticated attacker could possibly use this issue to create credentials or delegations that outlasted the delegated token. (CVE-2026-80182) It was discovered that OpenStack Keystone incorrectly handled role assignment queries under certain circumstances. An authenticated attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-80183) Tim Shephard discovered that OpenStack Keystone did not properly restrict reauthentication using delegated tokens. An authenticated attacker could possibly use this issue to escape their intended project scope and obtain unauthorized access. (CVE-2026-80184)

Several security issues were fixed in OpenStack Keystone.

Software Description:

- keystone: OpenStack identity service

Grzegorz Grasza discovered that OpenStack Keystone did not consistently

enforce restrictions for delegated authentication tokens. An authenticated

attacker could possibly use this issue to create credentials or delegations

that outlasted the delegated token. (CVE-2026-80182)

It was discovered that OpenStack Keystone incorrectly handled role

assignment queries under certain circumstances. An authenticated attacker

could possibly use this issue to obtain sensitive information. This

issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04

LTS, and Ubuntu 26.04 LTS. (CVE-2026-80183)

Tim Shephard discovered that OpenStack Keystone did not properly

restrict reauthentication using delegated tokens. An authenticated

attacker could possibly use this issue to escape their intended

project scope and obtain unauthorized access. (CVE-2026-80184)

The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS keystone 2:29.0.0-0ubuntu1.4 Ubuntu 24.04 LTS keystone 2:25.0.0-0ubuntu1.6 Ubuntu 22.04 LTS keystone 2:21.0.1-0ubuntu2.6 Ubuntu 20.04 LTS keystone 2:17.0.1-0ubuntu2+esm2 Available with Ubuntu Pro Ubuntu 18.04 LTS keystone 2:13.0.4-0ubuntu1+esm1 Available with Ubuntu Pro Ubuntu 16.04 LTS keystone 2:9.3.0-0ubuntu3.2+esm2 Available with Ubuntu Pro After a standard system update you need to restart keystone to make all the necessary changes.

CVE-2026-80182, CVE-2026-80183, CVE-2026-80184

Ubuntu Security Notice USN-8854-1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases