CVE-2026-44394

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-05-28 · updated 2026-10-26
Weakness: CWE-863

Description

An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone federated token rescoping mechanism does not propagate the original token's expiry to the newly issued token. When a federated user rescopes a token via POST /v3/auth/tokens, the handle_scoped_token() function in the mapped authentication plugin returns response data without an expires_at value. The token provider falls back to issuing a token with a fresh default TTL. By rescoping repeatedly before each token expires, a user can maintain access indefinitely, bypassing operator-configured token lifetime policies. This is a variant of CVE-2012-3426. Only deployments using federated identity (SAML2, OpenID Connect) are affected.

Affected products

OpenStack Keystone: from 14.0.0 before 27.0.2; from 28.0.0 before 28.0.2; from 29.0.0 before 29.0.2 — fixed in 27.0.2, 28.0.2, 29.0.2

How to fix

Upgrade to a fixed version: OpenStack Keystone 27.0.2, 28.0.2, 29.0.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-44394 or the next vulnerability affects your stack