-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 06 Oct 2026 20:06:28 +0200 Source: keystone Architecture: source Version: 2:27.0.0-3+deb13u6 Distribution: trixie-security Urgency: medium Maintainer: Debian OpenStack <team+openstack@tracker.debian.org> Changed-By: Thomas Goirand <zigo@debian.org> Closes: 1149303 1149956 Changes: keystone (2:27.0.0-3+deb13u6) trixie-security; urgency=medium . * CVE-2026-90460: Delegated tokens (like ec2credential, application_credential, ...) can GET/PATCH/DELETE any credential including TOTP seeds. Delegation project boundary not enforced on PATCH /v3/credentials/{id}. Applied upstream patch: "credentials: reject delegated tokens, restrict PATCH to blob only" (Closes: #1149303, #1149956): - CVE-2026-90460_lp-2159643_credentials_reject_delegated-tokens_re....patch Checksums-Sha1: 09fd88588cc9be231326b8154bdadf9b23aaed84 3486 keystone_27.0.0-3+deb13u6.dsc 896a6f57c727fa62d0aec10d5c8844b40cc42bdb 1098444 keystone_27.0.0.orig.tar.xz b56b31fc7f1763a4e22ad1f3f0c5e6e4c7daa68e 89448 keystone_27.0.0-3+deb13u6.debian.tar.xz 8a49c1280ba3644a044f8e16894b4a4bc6f9ed07 18938 keystone_27.0.0-3+deb13u6_amd64.buildinfo Checksums-Sha256: d8dad5550b5254809599adfb16330f07d124d9b92e5fa6ab28ab4602fb6a9ec7 3486 keystone_27.0.0-3+deb13u6.dsc 223b27dc676dabd6c9d67e4409fe086f92b5d47bf71ee8c724c3e0d13f26d635 1098444 keystone_27.0.0.orig.tar.xz 21a3dfd8904cf1616ed16a89c9f3e6daac6d287a7e17527c882298474eaf60c7 89448 keystone_27.0.0-3+deb13u6.debian.tar.xz 99a44ba2dba5b08f78fb8260abbb9a26ff8dbe81212e9f0738fb6f1448941b0b 18938 keystone_27.0.0-3+deb13u6_amd64.buildinfo Files: c3398356872e13542e0df92267c52f48 3486 net optional keystone_27.0.0-3+deb13u6.dsc d8119041a4ba1c4545ab5dabe9ae65b9 1098444 net optional keystone_27.0.0.orig.tar.xz d1af659b458b6f88b5ae55ad68ed56da 89448 net optional keystone_27.0.0-3+deb13u6.debian.tar.xz 5a75b199114e065670506b0b3f364a10 18938 net optional keystone_27.0.0-3+deb13u6_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmrKDOEACgkQ1BatFaxr Q/4zEBAAiTJpD6hJ4+9SptNDHk/6lr+kXoDO3634jbHEYVqUYh//O2SWNcKXM0ze VN2NL2A76UC5uIlynSXa6jAoy7GJYNwTp4t0NX8be4HgINeaGrj+t+Z0swEmoAAZ ptWCDmgLfahdq0zRgUDicJPT29cib60SoBPSTRgc1MOm4niChYA27mgw6uaLcrrT n1u1NNXg60mx5Hgt8HChasac32Om/fzeqi1O/JoK4QfCyeglB8aIWZ7dZWUyvvAA 9FZsPE0rVnnYu16Aa3B8v/rMV7JZJ+8CU2gCn+dKNdelGyAzR30p4tM9UL5T+Ku4 TXkgRnUqvFtQbFN4G4mh2RSCZyJqhGH3E5jlqrwZIoMmBdtt7COv2RxXwaIkaKiC tAWGGbHM8n8oF/8tvN9RukMoMALdlCqsiNZ5sX/BGr7MTxsjeojPlIbOsSwjQKSm N+MeuELXJVNdeo9CZoiaR3uOxfenTx4/hBPIli2kj3iAcSf7hCDR2V/He4NGlDUX KLAZsnm8I0LKY85PXMK6JAf6KCY2iR872m8se5WpjkUmnaykkBWBjci4v5ibsfk/ D3ApkPVa5UeXrgIV7Y1OzmDu4WhrzgGJifAIkhunbFneA78Ym7N2q0f/nfqXXjGw blZz99ysALPx8vvC1wcwyUAYq0f75JbsXFlVslO8zuqnmU3EdlA= =y9oi -----END PGP SIGNATURE-----
