CVE-2026-80183: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-80183 is an authorization bypass vulnerability in OpenStack Keystone that allows any authenticated user holding the role:reader on any project to enumerate all project-scoped role assignments across any domain. The flaw was published on August 27, 2026, and affects Keystone versions 16.0.0 through 27.0.2, 28.0.0 through 28.0.2, and 29.0.0 through 29.0.2. It carries a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory).

The root cause is a type confusion flaw (CWE-843) in the list_role_assignments_for_tree function, where Python's None value is mishandled during domain ID policy checks. When an attacker passes a domain ID as the scope.project.id parameter with include_subtree=true to the GET /v3/role_assignments endpoint, the domain's project record has domain_id=null, causing the policy check to evaluate as passing for any authenticated caller. Adding the include_names parameter to the request causes the API response to additionally disclose the names and home-domain IDs of every user, group, project, and role involved. Notably, the literal "default" domain ID is universally effective against any deployment initialized with keystone-manage bootstrap (GitHub Advisory, Launchpad Bug).

Successful exploitation allows any low-privileged authenticated user to enumerate the complete role assignment structure across the entire OpenStack cloud deployment, disclosing names and identifiers of all users, groups, projects, and roles. An attacker can harvest domain IDs from initial responses and iteratively repeat queries to fully map the cloud's identity and access management topology. While there is no direct integrity or availability impact, the exposed information significantly aids privilege escalation planning, lateral movement, and targeted attacks against specific accounts or projects (GitHub Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. However, the low barrier to exploitation — requiring only a valid role:reader credential and a standard HTTP GET request — makes it accessible to any authenticated cloud tenant (GitHub Advisory).

1. Obtain credentials: Acquire any valid OpenStack account with role:reader on at least one project — this could be a free trial, a compromised low-privilege account, or a self-provisioned tenant account.
2. Authenticate: Obtain a Keystone token via POST /v3/auth/tokens using the attacker's credentials scoped to any accessible project.
3. Initial enumeration using default domain: Send a crafted GET request using the well-known "default" domain ID: GET /v3/role_assignments?scope.project.id=<default_domain_id>&include_subtree=true&include_names=true with the obtained token in the X-Auth-Token header.
4. Parse response: Extract all user names, group names, project names, role names, and domain IDs returned in the response body.
5. Iterate across domains: Use harvested domain IDs to repeat the query for each domain, progressively mapping all role assignments across the entire cloud infrastructure.
6. Identify high-value targets: Analyze the collected data to identify admin accounts, privileged roles, and sensitive projects for further targeted attacks (GitHub Advisory, Launchpad Bug).

• Network: Repeated GET /v3/role_assignments requests from a single source IP containing both include_subtree=true and include_names=true query parameters; requests using multiple different domain IDs as scope.project.id in rapid succession.
• Logs: Keystone API access logs showing a low-privilege user (role:reader) making high-frequency calls to /v3/role_assignments with include_subtree and include_names parameters; requests cycling through multiple domain IDs from the same token or user.
• Behavioral: A single authenticated user querying role assignments across domains they do not administer; use of the literal "default" domain ID in scope.project.id by non-admin users.

Upgrade OpenStack Keystone to version 27.0.3, 28.0.3, or 29.0.3, which contain the fix for the list_role_assignments_for_tree logic. As a temporary workaround, restrict assignment of the role:reader role to trusted users only and limit network access to the GET /v3/role_assignments endpoint where feasible. Monitor Keystone API logs for suspicious use of include_subtree and include_names parameters, particularly from low-privilege accounts (GitHub Advisory, Launchpad Bug).