Skip to content

Commit da67de3

Browse files
garloffgarloff
authored
Merge branch 'main' into feat/add-osism-concepts
2 parents b3cb434 + f8cf209 commit da67de3

8 files changed

Lines changed: 305 additions & 158 deletions

File tree

‎CODEOWNERS‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# Members of the Project Board are the owners of the Community
2+
# Governance - see:
3+
# https://docs.scs.community/community/governance/project-board
4+
/community/governance/ @SovereignCloudStack/project-board
5+

‎blog/2026-05-28-keystone.md‎

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
---
2+
title: Multiple Keystone vulnerabilities affecting credential delegation and authorization (OSSA-2026-015)
3+
authors: [garloff]
4+
slug: keystone_credential_delegation_auth_bypass_ossa_2026_015
5+
tags: [security, openstack, keystone, cve]
6+
---
7+
8+
## The vulnerabilities
9+
10+
A series of five related vulnerabilities has been identified in OpenStack
11+
Keystone that impact how credentials are delegated and how authorization
12+
policies are enforced. These vulnerabilities allow authenticated attackers to
13+
bypass security boundaries, impersonate users, and potentially escalate
14+
privileges to cloud administrator.
15+
16+
The core issues are:
17+
18+
- **RBAC Policy Bypass (CVE-2026-42999):** An attacker can inject RBAC policy
19+
targets via a JSON request body, allowing them to bypass authorization on
20+
protected endpoints. This can lead to the reading of credential secrets and
21+
escalation to cloud admin.
22+
23+
- **Application Credential Impersonation (CVE-2026-42998 & CVE-2026-43000):**
24+
Keystone failed to verify if the caller owned the Application Credential
25+
being used. This allows for user impersonation within a project, which can be
26+
chained with "trust" operations to escalate privileges from a project member to
27+
an administrator.
28+
29+
- **Cross-Project EC2 Credentials (CVE-2026-43001):** Application credentials
30+
scoped to one project could be used to create EC2-style credentials for a
31+
different project, enabling lateral movement across tenant boundaries.
32+
33+
- **Federated Token Rescoping (CVE-2026-44394):** In SAML2/OIDC deployments,
34+
federated users can maintain access indefinitely by repeatedly rescoping
35+
tokens, as Keystone issues a fresh full-TTL token instead of inheriting the
36+
original expiry.
37+
38+
These issues were reported by Boris Bobrov (SAP SE), Tim Shepherd (roiai.ca),
39+
Erichen (Institute of Computing Technology, CAS), and Artem Goncharov
40+
(SysEleven GmbH).
41+
42+
## Impact on the SCS software ecosystem
43+
44+
These vulnerabilities pose a significant risk to SCS clouds. Because SCS
45+
environments rely heavily on S3 compatibility—which utilizes EC2-style
46+
credentials—the ability to perform cross-project lateral movement
47+
(CVE-2026-43001) is a direct threat to tenant isolation.
48+
49+
Furthermore, the RBAC bypass (CVE-2026-42999) is particularly severe as it
50+
undermines the fundamental security model of the cloud, potentially allowing an
51+
authenticated user to gain full administrative control over the entire Keystone
52+
service. For deployments using federated identity (SAML2/OIDC), the ability to
53+
bypass session expiration (CVE-2026-44394) also weakens the security posture
54+
regarding user lifecycle management.
55+
56+
## Embargo
57+
58+
The issues were reported to the OpenStack Vulnerability Management Team.
59+
Following coordination with the reporters and upstream developers, the official
60+
OpenStack Security Advisory
61+
[OSSA-2026-015](https://security.openstack.org/ossa/OSSA-2026-015.html) was
62+
published on Tuesday, 2026-05-28.
63+
64+
## Mitigation and Fixes
65+
66+
The primary remediation is to upgrade Keystone to the patched versions provided
67+
by the upstream OpenStack project.
68+
69+
**Note:** For users with highly customized trust policies, please be aware that
70+
the fix for CVE-2026-42999 modifies the trust policy structure. This may
71+
require manual updates to your custom policies to ensure continued
72+
functionality for services like Heat or image uploads.
73+
74+
The SCS ecosystem software providers are providing fixed Keystone images:
75+
76+
- [OSISM](https://osism.tech/docs/appendix/security/ossa-2026-015)
77+
- [yaook](https://yaook.cloud/security-advisories-cve-2026-42998-43001-44394/)
78+
79+
## Outlook
80+
81+
We see an increased velocity with which security issues are found in the
82+
IT industry. We're glad to see them reported against the open source projects
83+
that we are using and the community is working hard to address the issues.
84+
Security researchers have become more efficient due to the usage of AI tools
85+
and so have OSS developers - we expect the high volume to continue for the
86+
upcoming months and maybe beyond.
87+
88+
SCS has always emphasized the ability to patch with confidence on a daily basis
89+
as an important design criterium for the lifecycle management of our components.
90+
It now seems to be needed more than ever. We advise operators to prepare for
91+
this new world and ensure to work on any processual issues that are slowing
92+
them down in deployment.
93+
94+
## References
95+
96+
- [OSSA-2026-015 Advisory](https://security.openstack.org/ossa/OSSA-2026-015.html)
97+
- [Launchpad Bug #2148398](https://bugs.launchpad.net/keystone/+bug/2148398),
98+
[#2148477](https://bugs.launchpad.net/keystone/+bug/2148477),
99+
[#2149775](https://bugs.launchpad.net/keystone/+bug/2149775),
100+
[#2149789](https://bugs.launchpad.net/keystone/+bug/2149789),
101+
[#2150089](https://bugs.launchpad.net/keystone/+bug/2150089),
102+
[#2150379](https://bugs.launchpad.net/keystone/+bug/2150379)
103+
- [CVE-2026-42998](https://www.cve.org/CVERecord?id=CVE-2026-42998),
104+
[CVE-2026-42999](https://www.cve.org/CVERecord?id=CVE-2026-42999),
105+
[CVE-2026-43000](https://www.cve.org/CVERecord?id=CVE-2026-43000),
106+
[CVE-2026-43001](https://www.cve.org/CVERecord?id=CVE-2026-43001),
107+
[CVE-2026-44394](https://www.cve.org/CVERecord?id=CVE-2026-44394)
108+
109+
## Thanks
110+
111+
The author would like to thank Boris Bobrov, Tim Shepherd, Erichen, and Artem
112+
Goncharov for their work in discovering and reporting these critical
113+
vulnerabilities and the OpenStack Vulnerability Management Team for handling
114+
and coordinating this and the OpenStack Keystone upstream developers for
115+
addressing the issues.
116+
117+
## Sovereign Cloud Stack Security Contact
118+
119+
SCS security contact is
120+
[security@scs.community](mailto:security@scs.community), as published on
121+
[https://sovereigncloudstack.org/.well-known/security.txt](https://sovereigncloudstack.org/.well-known/security.txt).
122+
123+
## Version history
124+
125+
- Initial draft, v0.1, 2026-05-28, 16:00 CEST
126+
- Release, v1.0, 2026-05-29, 12:00 CEST

‎blog/2026-06-16-cve-2026-46448.md‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
---
2+
title: Lacking sanitization of Nova scheduler hints (OSSA-2026-022 / CVE-2026-46448)
3+
authors: [garloff]
4+
slug: nova_lacking_scheulder_hints_sanitization_ossa_2026_022
5+
tags: [security, openstack, nova, cve]
6+
---
7+
8+
## The vulnerability
9+
10+
When talking to the OpenStack Nova Compute API, Users can specify scheduler
11+
hints, expressing preferences for Server (VM) placement. Users can however
12+
inject a values `{"_nova_check_type": "rebuild"}` that is only meant to be used
13+
internally in the rebuild context which causes certain resource checks to be
14+
skipped. This can cause placement contraints such as host aggregates, AZs, image
15+
traits to be ignored and cause PCI pass-through resources to not be properly
16+
mapped. While the assigned quota is still observed, the vulnerability may cause
17+
exhaustion of resources and confusion of the scheduler (placement) state and
18+
thus may result in a Denial of Service for certain resource types.
19+
20+
This issue was reported by Erichen, Institute of Computing Technology, Chinese
21+
Academy of Sciences and was subsequently analyzed and handled by Goutham Pacha Ravi,
22+
Dan Smith and Sylvain Bauza. It was assigned CVE-2026-46448.
23+
24+
## Impact on the SCS software ecosystem
25+
26+
Malevolent authenticated users could use this to schedule VMs on hosts that
27+
would normally not be accessible to their VMs (e.g. because they are in a
28+
host aggregate only available to GPU flavors which are manually enabled for
29+
selected customers only). This could result in resource exhaustion for
30+
legitimate users and cause the placement accounting to be confused.
31+
32+
This will mainly affect providers that exposed specialized features via
33+
special flavors (such as e.g. GPUs) which may be scarce. In particular,
34+
PCI devices may be assigned without proper accounting in the placement
35+
service.
36+
37+
## Embargo
38+
39+
The issue was reported to the OpenStack Vulnerability Management Team.
40+
Following coordination with the reporters and upstream developers, the official
41+
OpenStack Security Advisory
42+
[OSSA-2026-022](https://security.openstack.org/ossa/OSSA-2026-022.html) was
43+
published on Tuesday, 2026-06-16, 15:00 UTC.
44+
45+
## Mitigation and Fixes
46+
47+
The fix consists in ensuring that internal `_nova_` scheduler hints are properly
48+
filtered out in the API exposed to users.
49+
50+
Providers are advised to deploy fixed nova-api containers.
51+
The SCS ecosystem software providers will provide fixed nova images along with
52+
update instructions.
53+
54+
- [OSISM](https://osism.tech/docs/appendix/security/ossa-2026-022)
55+
- [yaook](https://yaook.cloud/security-advisories-cve-2026-46448/)
56+
57+
Operators where users may have caused confusion in the placement accounting
58+
will need to run
59+
60+
```shell
61+
nova-manage placement heal_allocations
62+
```
63+
64+
to ensure that accounting in the placement service is consistent again.
65+
66+
## References
67+
68+
- [OSSA-2026-022 Advisory](https://security.openstack.org/ossa/OSSA-2026-022.html)
69+
- [Launchpad Bug #2151252](https://bugs.launchpad.net/nova/+bug/2151252)
70+
71+
## Thanks
72+
73+
The author would like to thank the reporters, the OpenStack vulnerability
74+
management team and the abovementioned maintainers for reporting,
75+
analyzing, fixing and handling the issue.
76+
77+
## Sovereign Cloud Stack Security Contact
78+
79+
SCS security contact is
80+
[security@scs.community](mailto:security@scs.community), as published on
81+
[https://sovereigncloudstack.org/.well-known/security.txt](https://sovereigncloudstack.org/.well-known/security.txt).
82+
83+
## Version history
84+
85+
- Initial draft, v0.5, 2026-06-16, 13:30 CEST
86+
- Initial publication, v1.0, 2026-06-16, 17:00 CEST
87+
- Link OSISM advisory, v1.1, 2026-06-16, 19:30 CEST
88+
- Link yaook advisory, v1.2, 2026-06-17, 13:30 CEST

‎community/governance/project-board-2025.md‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
# Project Board Term 2025
2+
3+
For the term 2025 the project board consisted of:
4+
5+
Spokesperson: Felix Kronlage-Dammers, @fkr
6+
7+
| Name, Firstname | Github Handle | E-Mail | Remark |
8+
| ----------------------- | ---------------------------------------------- | ------------------------------------------------------------- | ------------------------------ |
9+
| Berendt, Christian | [@berendt](https://github.com/berendt) | [berendt@osism.tech](mailto:berendt@osism.tech) | Elected by Community |
10+
| Feder, Matej | [@matofeder](https://github.com/matofeder) | [matej.feder@dnation.cloud](mailto:matej.feder@dnation.cloud) | Elected by Community |
11+
| Garloff, Kurt | [@garloff](https://github.com/garloff) | [scs@garloff.de](mailto:scs@garloff.de) | Elected by Community |
12+
| Kronlage-Dammers, Felix | [@fkr](https://github.com/fkr) | [fkr@osb-alliance.com](mailto:fkr@osb-alliance.com) | Represents Forum SCS-Standards |
13+
| Schoone, Jan | [@jschoone](https://github.com/jschoone) | [jan.schoone@uhurutec.com](mailto:jan.schoone@uhurutec.com) | Elected by Community |
14+
15+
## Project Board Term 2025 Nominees
16+
17+
For the project board election for the term 2025 the following people were nominated or have nominated themselves:
18+
19+
| Name, Firstname | Github Handle | E-Mail |
20+
| ------------------- | ------------------------------------------------------ | ---------------------------------------------------------------------------------- |
21+
| Bayr, Michael | [@michaelbayr](https://github.com/michaelbayr) | [mb@artcodix.com](mailto:mb@artcodix.com) |
22+
| Berendt, Christian | [@berendt](https://github.com/berendt) | [berendt@osism.tech](mailto:berendt@osism.tech) |
23+
| Büchse, Matthias | [@mbuechse](https://github.com/mbuechse) | [matthias.buechse@cloudandheat.com](mailto:matthias.buechse@cloudandheat.com) |
24+
| Feder, Matej | [@matofeder](https://github.com/matofeder) | [matej.feder@dnation.cloud](mailto:matej.feder@dnation.cloud) |
25+
| Garloff, Kurt | [@garloff](https://github.com/garloff) | [scs@garloff.de](mailto:scs@garloff.de) |
26+
| Kemper, Janis | [@janiskemper](https://github.com/janiskemper) | [janis.kemper@syself.com](mailto:janis.kemper@syself.com) |
27+
| Schäfer, Jonas | [@horazont](https://github.com/horazont) | [jonas.schaefer@cloudandheat.com](mailto:jonas.schaefer@cloudandheat.com) |
28+
| Schoone, Jan | [@jschoone](https://github.com/jschoone) | [jan.schoone@uhurutec.com](mailto:jan.schoone@uhurutec.com) |
29+
| Wolf, Tobias | [@NotTheEvilOne](https://github.com/NotTheEvilOne) | [wolf@b1-systems.de](mailto:wolf@b1-systems.de) |

‎community/governance/project-board.md‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,20 @@ Spokesperson: Kurt Garloff, @garloff
1414
| Bayr, Michael | [@michaelbayr](https://github.com/michaelbayr) | [mb@artcodix.com](mailto:mb@artcodix.com) | Elected by Community |
1515
| Garloff, Kurt | [@garloff](https://github.com/garloff) | [scs@garloff.de](mailto:scs@garloff.de) | Elected by Community |
1616
| Kemper, Janis | [@janiskemper](https://github.com/janiskemper) | [janis.kemper@syself.com](mailto:janis.kemper@syself.com) | Deputy Representative Forum SCS-Standards |
17-
| Klare, Jan | [@jklare](https://github.com/jklare) | [klare@osism.tech](mailto:klare@osism.tech) | Elected by Community |
17+
| Klare, Jan | [@jklare](https://github.com/jklare) | [klare@osism.de](mailto:klare@osism.de) | Elected by Community |
1818
| Kronlage-Dammers, Felix | [@fkr](https://github.com/fkr) | [fkr@osb-alliance.com](mailto:fkr@osb-alliance.com) | Represents Forum SCS-Standards |
1919
| Schoone, Jan | [@jschoone](https://github.com/jschoone) | [jan.schoone@uhurutec.com](mailto:jan.schoone@uhurutec.com) | Elected by Community |
20+
21+
## Project Board Term 2026 Nominees
22+
23+
For the project board election for the term 2026 the following people were nominated or have nominated themselves:
24+
25+
| Name, Firstname | Github Handle | E-Mail |
26+
| ------------------- | ------------------------------------------------ | ------------------------------------------------------------------- |
27+
| Bayr, Michael | [@michaelbayr](https://github.com/michaelbayr) | [mb@artcodix.com](mailto:mb@artcodix.com) |
28+
| Berendt, Christian | [@berendt](https://github.com/berendt) | [berendt@osism.tech](mailto:berendt@osism.tech) |
29+
| Garloff, Kurt | [@garloff](https://github.com/garloff) | [scs@garloff.de](mailto:scs@garloff.de) |
30+
| Klare, Jan | [@jklare](https://github.com/jklare) | [klare@osism.de](mailto:klare@osism.de) |
31+
| Pilka, Martin | [@mpilka](https://github.com/mpilka) | [martin.pilka@dnation.cloud](mailto:martin.pilka@dnation.cloud) |
32+
| Schöchlin, Marc | [@scoopex](https://github.com/scoopex) | [marc.schoechlin@uhurutec.com](mailto:marc.schoechlin@uhurutec.com) |
33+
| Schoone, Jan | [@jschoone](https://github.com/jschoone) | [jan.schoone@uhurutec.com](mailto:jan.schoone@uhurutec.com) |

0 commit comments

Comments
 (0)