CVE-2026-90460General

LOWCVSS 7.6 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods (EC2 credentials, application credentials, OAuth1 access tokens, and trusts) are not blocked from creating, modifying, or deleting credentials via the /v3/credentials API. EC2-derived tokens can additionally read credential blobs, exposing TOTP MFA seeds and other secrets. Also, PATCH /v3/credentials does not validate the requested post-update project_id, allowing any delegated token to move a credential to an unauthorized project. All Keystone deployments using delegated authentication are affected.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-863

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

2 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 1 signal
General: 1 classified signal
Disclosure: 1 classified signal
Peaked 1d ago at 1 mentions (2026-09-12); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Signal classification2 categories

General

150.0%

Disclosure

150.0%

Referenced assets1 URL

By indicator

https://www.cve.org/CVERecord?id=CVE-2026-90460

Classification over time

Date	Total	Labels

2026-09-12	1	General1
2026-10-13	1	Disclosure1

Full discourse2 posts

0x870x4k3r@pepetheshneine16d
Disclosure
A delegated credential is supposed to reduce scope, not become a path back to secrets. OpenStack Keystone CVE-2026-90460 breaks that assumption in certain delegated-token flows. https://t.co/qH3bbjxp8A
Post summary
The tweet announces CVE-2026-90460 in OpenStack Keystone, describing a flaw in delegated-token flows where credentials can escalate to expose secrets, but provides no PoC, exploit, patch, or active exploitation evidence.
10000301
30 followersView on X
CVE@CVEnew47d
General
CVE-2026-90460 An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods (EC2 credentials, application credentials, OAuth1 ac… https://www.cve.org/CVERecord?id=CVE-2026-90460
Post summary
The text briefly notes that CVE-2026-90460 was found in OpenStack Keystone before version 29.0.3, mentioning problematic token acquisition via delegated authentication, but it lacks detailed technical info, PoC, exploit, patch, or evidence of active exploitation.
000001.7K
58.1K followersView on X

Explore more

Back to dashboard