CVE-2026-44394

Description

A flaw was found in OpenStack Keystone. The federated token rescoping mechanism does not correctly propagate the original token's expiry to newly issued tokens. This allows a federated user to repeatedly rescope a token before it expires, effectively maintaining indefinite access and bypassing configured token lifetime policies. This vulnerability can lead to unauthorized persistent access to resources.

Statement

This MODERATE token lifetime bypass in Keystone affects federated identity deployments (SAML2, OIDC). Authenticated users can maintain indefinite access by repeatedly rescoping tokens before expiry. High complexity reflects the federated identity requirement. Impact is low confidentiality and integrity as this maintains existing access rather than gaining new privileges. Fixed in version 29.0.2.

Common Vulnerability Scoring System (CVSS) Score Details

Info alert:Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).

The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 Score Breakdown

Red HatNVDcve.org
Base Score4.98.1N/A
Attack VectorNetworkNetworkN/A
Attack ComplexityHighLowN/A
Privileges RequiredLowLowN/A
User InteractionNoneNoneN/A
ScopeChangedUnchangedN/A
ConfidentialityLowHighN/A
Integrity ImpactLowHighN/A
Availability ImpactNoneNoneN/A

Vector

Red Hat: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

NVD: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Understanding the Weakness (CWE)

CWE-613

Access Control

Technical Impact: Bypass Protection Mechanism

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.