CVE-2026-44394

{
  "id": "CVE-2026-44394",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-28T19:16:38.223",
  "lastModified": "2026-10-26T13:10:00.140",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone federated token rescoping mechanism does not propagate the original token's expiry to the newly issued token. When a federated user rescopes a token via POST /v3/auth/tokens, the handle_scoped_token() function in the mapped authentication plugin returns response data without an expires_at value. The token provider falls back to issuing a token with a fresh default TTL. By rescoping repeatedly before each token expires, a user can maintain access indefinitely, bypassing operator-configured token lifetime policies. This is a variant of CVE-2012-3426. Only deployments using federated identity (SAML2, OpenID Connect) are affected."
    },
    {
      "lang": "es",
      "value": "Se descubrió un problema en OpenStack Keystone anterior a la versión 29.0.2. El mecanismo de re-alcance de tokens federados de Keystone no propaga la caducidad del token original al token recién emitido. Cuando un usuario federado re-alcanza un token a través de POST /v3/auth/tokens, la función handle_scoped_token() en el plugin de autenticación mapeado devuelve datos de respuesta sin un valor expires_at. El proveedor de tokens recurre a emitir un token con un TTL predeterminado nuevo. Al re-alcanzar repetidamente antes de que cada token caduque, un usuario puede mantener el acceso indefinidamente, eludiendo las políticas de vida útil del token configuradas por el operador. Esta es una variante de CVE-2012-3426. Solo las implementaciones que utilizan identidad federada (SAML2, OpenID Connect) se ven afectadas."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "OpenStack",
          "product": "Keystone",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "14.0.0",
              "lessThan": "27.0.2",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "28.0.0",
              "lessThan": "28.0.2",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "29.0.0",
              "lessThan": "29.0.2",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
          "baseScore": 6.0,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.7
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-28T19:42:48.576995Z",
          "id": "CVE-2026-44394",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "14.0.0",
              "versionEndExcluding": "27.0.2",
              "matchCriteriaId": "541F5133-3C0B-4973-BEDC-1A7D4BA292CA"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "28.0.0",
              "versionEndExcluding": "28.0.2",
              "matchCriteriaId": "EE1CC117-FDCA-493D-B811-57BC9ADC9260"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "29.0.0",
              "versionEndExcluding": "29.0.2",
              "matchCriteriaId": "594C43ED-BCAE-43C2-9B5F-5D4AF2F2AC08"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://bugs.launchpad.net/keystone/+bug/2150379",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://security.openstack.org/ossa/OSSA-2026-015.html",
      "source": "[email protected]",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ]
    }
  ]
}