In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms (OAuth1 access tokens, application credentials, trusts) could be submitted to the token-method authentication path for reauthentication to escape their intended project scope. When an application credential token was presented with no explicit scope, Keystone would issue a new token scoped to the credential owner's default project rather than the project for which the credential was issued, bypassing the intended project boundary. All Keystone deployments that permit delegated authentication through OAuth1 access tokens, application credentials, or trusts are affected.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4767 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4767-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/               Emilio Pozuelo Monfort     September 02, 2026                            https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : keystone     Version        : 2:22.0.2-0+deb12u4     CVE ID         : CVE-2026-80182 CVE-2026-80183 CVE-2026-80184

    Multiple vulnerabilities were discovered in Keystone, the OpenStack     identity service, which may result in authorisation bypass or     information disclosure.

    For Debian 12 bookworm, these problems have been fixed in version     2:22.0.2-0+deb12u4.

    We recommend that you upgrade your keystone packages.

    For the detailed security status of keystone please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/keystone

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6480 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6480-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     September 01, 2026                    https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : keystone     CVE ID         : CVE-2026-80182 CVE-2026-80183 CVE-2026-80184

    Multiple vulnerabilities were discovered in Keystone, the OpenStack     identity service, which may result in authorisation bypass or     information disclosure.

    For the stable distribution (trixie), these problems have been fixed in     version 2:27.0.0-3+deb13u5.

    We recommend that you upgrade your keystone packages.

    For the detailed security status of keystone please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/keystone

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms (OAuth1     access tokens, application credentials, trusts) could be submitted to the token-method authentication path     for reauthentication to escape their intended project scope. When an application credential token was     presented with no explicit scope, Keystone would issue a new token scoped to the credential owner's     default project rather than the project for which the credential was issued, bypassing the intended     project boundary. All Keystone deployments that permit delegated authentication through OAuth1 access     tokens, application credentials, or trusts are affected. (CVE-2026-80184)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
342531	Debian dla-4767 : keystone - security update	Nessus	Debian Local Security Checks	Local	high
342262	Debian dsa-6480 : keystone - security update	Nessus	Debian Local Security Checks	Local	high
339914	Linux Distros Unpatched Vulnerability : CVE-2026-80184	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-80184

high

Tenable Plugins

high

high

high