tocsin

PyPI/keystone CVE-2026-44394: high 8.1, EPSS 0.32%

An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone federated token rescoping mechanism does not propagate the original token's expiry to the newly issued token. When a federated

Action: Upgrade keystone to 27.0.2 or later.

pip install keystone==27.0.2
pip install keystone==28.0.2
pip install keystone==29.0.2

Affected

introducedfixedlast affected
14.0.027.0.2-
28.0.028.0.2-
29.0.029.0.2-

Fixed versions

27.0.228.0.229.0.2

Sources

CVE-2026-44394 · published · modified · JSON