Vulnerability Description
An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone federated token rescoping mechanism does not propagate the original token's expiry to the newly issued token. When a federated user rescopes a token via POST /v3/auth/tokens, the handle_scoped_token() function in the mapped authentication plugin returns response data without an expires_at value. The token provider falls back to issuing a token with a fresh default TTL. By rescoping repeatedly before each token expires, a user can maintain access indefinitely, bypassing operator-configured token lifetime policies. This is a variant of CVE-2012-3426. Only deployments using federated identity (SAML2, OpenID Connect) are affected.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openstack | Keystone | >= 14.0.0, < 27.0.2 |
Related Weaknesses (CWE)
References
- https://bugs.launchpad.net/keystone/+bug/2150379ExploitIssue TrackingPatch
- https://security.openstack.org/ossa/OSSA-2026-015.htmlPatchVendor Advisory
FAQ
What is CVE-2026-44394?
CVE-2026-44394 is a vulnerability with a CVSS score of 6.0 (MEDIUM). An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone federated token rescoping mechanism does not propagate the original token's expiry to the newly issued token. When a federated...
How severe is CVE-2026-44394?
CVE-2026-44394 has been rated MEDIUM with a CVSS base score of 6.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-44394?
Check the references section above for vendor advisories and patch information. Affected products include: Openstack Keystone.