6

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44394

CVE-2026-44394: OpenStack Keystone's federated token rescoping mechanism doesn't propagate the original token's expiry to the newly issued token

An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone federated token rescoping mechanism does not propagate the original token's expiry to the newly issued token. When a federated user rescopes a token via POST /v3/auth/tokens, the handle_scoped_token() function in the mapped authentication plugin returns response data without an expires_at value. The token provider falls back to issuing a token with a fresh default TTL. By rescoping repeatedly before each token expires, a user can maintain access indefinitely, bypassing operator-configured token lifetime policies. This is a variant of CVE-2012-3426. Only deployments using federated identity (SAML2, OpenID Connect) are affected.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44394

CVE-2026-44394:

6

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
keystone	pip	>= 14.0.0, < 27.0.2	27.0.2
keystone	pip	>= 28.0.0, < 28.0.2	28.0.2
keystone	pip	>= 29.0.0, < 29.0.2	29.0.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided security vulnerability and associated patches indicates that the root cause of the issue lies within the handle_scoped_token function in keystone/auth/plugins/mapped.py. The vulnerability, identified as CVE-2026-44394, allows an authenticated user with a federated token to bypass token expiration policies. When such a user requests a new scoped token, the handle_scoped_token function does not preserve the original token's expiration time (expires_at). Consequently, the token provider issues a new token with a fresh, default Time-To-Live (TTL). By repeatedly performing this action before the token expires, a user can indefinitely extend their session. The provided patch addresses this by explicitly adding the expires_at value from the original token to the response data, ensuring the new token inherits the correct expiration time. The commit f94605302a742598478328426240b1e2b6a0d6e4 clearly shows the addition of response_data['expires_at'] = token.expires_at to the handle_scoped_token function, which directly mitigates the vulnerability.

Vulnerable functions

keystone.auth.plugins.mapped.handle_scoped_token

keystone/auth/plugins/mapped.py

The function `handle_scoped_token` is vulnerable because it fails to propagate the `expires_at` attribute from the original federated token when creating a new, rescoped token. The function constructs `response_data` without including the expiry information. This causes the downstream token issuance logic to fall back to a default TTL, effectively resetting the token's lifetime. An attacker can repeatedly rescope their token before it expires to maintain persistent access, bypassing configured token lifetime policies.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.