)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"59338d2b65c6a7c54b507ec529ebabdb798bfc0f","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":3,"id":"c4c177c4_b972d5d9","updated":"2026-08-25 21:28:52.000000000","message":"Just generally curious: do you think other openstack projects (or maybe keystonemiddleware) SHOULD inspect token.methods?","commit_id":"9e153b5db2bb8496aa848136cd7f7ffb9e6cfe13"},{"author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"change_message_id":"b38b22916fd4ffc8fefca3557e02a90cb954d08e","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":3,"id":"ab2ae5d2_ec457f6b","in_reply_to":"c4c177c4_b972d5d9","updated":"2026-08-25 22:16:19.000000000","message":"All of the mentioned patches are in flight, so I\u0027m not yet sure what the final shape of these will be, but it gets complicated.\n\nWe divided the auth methods into primary and non-primary in this last set of patches, but you can also implement custom auth plugins. So we introduced a config, which lets the operator set their additional plugins as \"primary\". As proposed, only primary tokens can be re-scoped (ex. to switch projects in Horizon). This config would only be present in keystone - other services would have to duplicate it.\n\nThe main issue we are plugging in keystone, was that you could hop between the differently issued tokens back and forth, which looks like an issue limited to Keystone. But there are secondary issues I\u0027m currently thinking about, like when you have MFA enabled, should your application credential be able to change an ssh key in Nova? Nova wouldn\u0027t know if you have MFA enabled just by token introspection...","commit_id":"9e153b5db2bb8496aa848136cd7f7ffb9e6cfe13"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"af7ff9a7f80f33cf6f1bb6eb13fb807e81ab44bc","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":4,"id":"3bec6142_e930de56","updated":"2026-08-27 17:07:30.000000000","message":"Hey Grzegorz, we changed the format of OSSN. I used Claude-code (and my own brain) to translate this into the new yaml format. Let me know if there are any questions.","commit_id":"af299970498913f85406865450f45d763f914831"},{"author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"change_message_id":"7b1ab2f954b567feee07dda6b46ece9db3bf81cd","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":5,"id":"17193c87_0e2c7600","updated":"2026-10-07 21:46:15.000000000","message":"@xek@redhat.com and I spoke about another EC2 creds issue [1] that could ride on this OSSN. Please consider it, and re-number because we\u0027re about to ship a different note as OSSN-0109:https://review.opendev.org/c/openstack/security-doc/+/1007657\n\n\n[1] https://bugs.launchpad.net/keystone/+bug/2165281","commit_id":"9bbd152a0c8d88c4725100b7e33338f679856b9e"},{"author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"change_message_id":"85488f30d36d57f56f1524c076f11190ad4af6c4","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":5,"id":"c28f1a4c_15d822e0","updated":"2026-10-09 08:29:30.000000000","message":"I\u0027ll be updating this with the newly published findings:\n\n  1. LP#2167625 — EC2 credential scope bypass (restricted app-cred → OS-EC2 → full roles)\n\n     https://bugs.launchpad.net/bugs/2167625 — public 2026-10-02\n\n  2. LP#2164968 — /v3/ec2tokens / /v3/s3tokens skip expires_at on trust / app-cred / OAuth1\n\n     https://bugs.launchpad.net/bugs/2164968 — public 2026-10-02\n\n  3. LP#2165281 — EC2/S3 blobs trust client-supplied trust_id (impersonate trustor)\n\n     https://bugs.launchpad.net/bugs/2165281 — public 2026-10-07","commit_id":"9bbd152a0c8d88c4725100b7e33338f679856b9e"},{"author":{"_account_id":38496,"name":"Andressa Cabistani","display_name":"Andressa","email":"acabistani@gmail.com","username":"andressadotpy","status":"I\u0027m a Software Engineer at Red Hat and I love Open Source and connect with people! Feel free to DM through IRC, I\u0027ll be delighted to chat"},"change_message_id":"cd6aa7aa94317ee2644d419243eaffb605a624ee","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":5,"id":"3e87f991_8a6bfeba","updated":"2026-09-21 12:51:22.000000000","message":"More info here: https://lists.openstack.org/archives/list/openstack-discuss@lists.openstack.org/thread/VD2UO5N6MW6OCOSTT7PMPQ5ZBFCNP3BX/","commit_id":"9bbd152a0c8d88c4725100b7e33338f679856b9e"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"2d47450e001a6ea5b6d1744d180523c6e3be04ff","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":5,"id":"f87c1823_a6e5679c","updated":"2026-09-04 18:05:12.000000000","message":"This will need a date field added and populated with the merge date whenever we\u0027re ready to land it.","commit_id":"9bbd152a0c8d88c4725100b7e33338f679856b9e"},{"author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"change_message_id":"d180aac9b8bca40a4bfa8648c397fbbef5935777","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":8,"id":"b2369f63_c04bdf2e","updated":"2026-10-09 20:16:31.000000000","message":"Also you\u0027ve mentioned 0111 in this, and 0112 in the other note. So i assume both have to be shipped out together?","commit_id":"53e82298edfede28eea8ac6c6ec5fe7433628fe0"},{"author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"change_message_id":"fdcb1e546b46217037474f8d7efd85633e1f9d68","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":8,"id":"e7d3f2f2_83c252ba","updated":"2026-10-09 20:15:55.000000000","message":"Same question about verbosity here.","commit_id":"53e82298edfede28eea8ac6c6ec5fe7433628fe0"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"c7f51353c024550b9fc8d3b97df242a3e3d21eb4","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":8,"id":"dac64a4c_9577097f","updated":"2026-10-09 17:44:11.000000000","message":"Some question as to if we should announce an OSSN on a Friday (we target Tues-Thurs, no holidays for OSSAs).","commit_id":"53e82298edfede28eea8ac6c6ec5fe7433628fe0"}],"security-notes/OSSN-0109":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"114c195d10eba8b54f50db59241e527ec7aeb571","unresolved":true,"context_lines":[{"line_number":91,"context_line":"If a deployment does not use Swift\u0027s S3-compatible API (or any other"},{"line_number":92,"context_line":"consumer of EC2-style credentials), disable the feature entirely with a"},{"line_number":93,"context_line":"`policy.yaml` override. There is no code-level switch for this, so the"},{"line_number":94,"context_line":"override must deny every EC2-related policy target directly:"},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"~~~"},{"line_number":97,"context_line":"# Drop in as Keystone\u0027s policy.yaml"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"d27bda37_0faa9378","line":94,"updated":"2026-08-25 21:12:28.000000000","message":"Recently when Ironic issued a similarly shaped OSSN, we also suggested folks could use a fronting proxy service or WSGI configuration to block troublesome URLs. If that\u0027s an option here, it might be worth mentioning. ( https://wiki.openstack.org/wiki/OSSN/OSSN-0106 )","commit_id":"66b5810c03e12fa6677e0d0e8d5b0aaa14a3bc7a"},{"author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"change_message_id":"5cf368f61004d03ef1d4e85e87fc57dc89ef4266","unresolved":false,"context_lines":[{"line_number":91,"context_line":"If a deployment does not use Swift\u0027s S3-compatible API (or any other"},{"line_number":92,"context_line":"consumer of EC2-style credentials), disable the feature entirely with a"},{"line_number":93,"context_line":"`policy.yaml` override. There is no code-level switch for this, so the"},{"line_number":94,"context_line":"override must deny every EC2-related policy target directly:"},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"~~~"},{"line_number":97,"context_line":"# Drop in as Keystone\u0027s policy.yaml"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"1505b195_d686c4cd","line":94,"in_reply_to":"d27bda37_0faa9378","updated":"2026-08-25 21:23:40.000000000","message":"Thanks for the review, I\u0027ll add those in, it won\u0027t cover the credentials endpoint though","commit_id":"66b5810c03e12fa6677e0d0e8d5b0aaa14a3bc7a"}],"security-notes/OSSN-0109.yaml":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"ccb0935b8d6045648603cf513036ec7f7c1f971d","unresolved":true,"context_lines":[{"line_number":158,"context_line":"    fully-privileged token for the credential\u0027s project."},{"line_number":159,"context_line":""},{"line_number":160,"context_line":"credits:"},{"line_number":161,"context_line":"  - Sergey Kanibor (bug 2158931)"},{"line_number":162,"context_line":""},{"line_number":163,"context_line":"references:"},{"line_number":164,"context_line":"  links:"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"3706d310_508e100f","line":161,"updated":"2026-08-27 17:08:04.000000000","message":"noticed this during my translation: these usually credit the organization/employer in (), not the bug -- although it\u0027s still useful metadata if you wanna include it.","commit_id":"af299970498913f85406865450f45d763f914831"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"4586445faacc9a0f3d67b6c9ca2f00425c4a6242","unresolved":true,"context_lines":[{"line_number":179,"context_line":"  - description: CVE-2026-2035364"},{"line_number":180,"context_line":"    url: https://nvd.nist.gov/vuln/detail/CVE-2026-2035364"},{"line_number":181,"context_line":"  - description: CVE-2026-2035366"},{"line_number":182,"context_line":"    url: https://nvd.nist.gov/vuln/detail/CVE-2026-2035366"},{"line_number":183,"context_line":""},{"line_number":184,"context_line":"author: Grzegorz Grasza, Red Hat"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"7ac96404_31942167","line":182,"updated":"2026-08-27 17:12:28.000000000","message":"These CVE numbers match the original ones from the txt version, but look strange -- are these CAN IDs?","commit_id":"af299970498913f85406865450f45d763f914831"},{"author":{"_account_id":38496,"name":"Andressa Cabistani","display_name":"Andressa","email":"acabistani@gmail.com","username":"andressadotpy","status":"I\u0027m a Software Engineer at Red Hat and I love Open Source and connect with people! Feel free to DM through IRC, I\u0027ll be delighted to chat"},"change_message_id":"cd6aa7aa94317ee2644d419243eaffb605a624ee","unresolved":true,"context_lines":[{"line_number":102,"context_line":""},{"line_number":103,"context_line":"    # --- Token exchange ----------------------------------------------------"},{"line_number":104,"context_line":"    \"identity:ec2tokens_validate\": \"!\""},{"line_number":105,"context_line":"    \"identity:s3tokens_validate\": \"!\""},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"    # --- Generic /v3/credentials API ---------------------------------------"},{"line_number":108,"context_line":"    # other types stay on the default rules."}],"source_content_type":"text/x-yaml","patch_set":5,"id":"4b9037b7_abf4ad1a","line":105,"updated":"2026-09-21 12:51:22.000000000","message":"This rule takes down Swift\u0027s S3 API entirely — /v3/s3tokens is called on every S3 request, and the client sees a misleading `SignatureDoesNotMatch` while the real 403 is only in the Keystone log. `\"role:service\"` works instead and keeps most of the benefit: only the Swift service account can convert a signature into a token. Tested rule-by-rule, details here: https://lists.openstack.org/archives/list/openstack-discuss@lists.openstack.org/thread/VD2UO5N6MW6OCOSTT7PMPQ5ZBFCNP3BX/","commit_id":"9bbd152a0c8d88c4725100b7e33338f679856b9e"},{"author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"change_message_id":"3a893651efbf3c4a64c51cac23ef6e60f9e8ffc9","unresolved":true,"context_lines":[{"line_number":102,"context_line":""},{"line_number":103,"context_line":"    # --- Token exchange ----------------------------------------------------"},{"line_number":104,"context_line":"    \"identity:ec2tokens_validate\": \"!\""},{"line_number":105,"context_line":"    \"identity:s3tokens_validate\": \"!\""},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"    # --- Generic /v3/credentials API ---------------------------------------"},{"line_number":108,"context_line":"    # other types stay on the default rules."}],"source_content_type":"text/x-yaml","patch_set":5,"id":"6e6d7495_17c48e7d","line":105,"in_reply_to":"4b9037b7_abf4ad1a","updated":"2026-09-25 09:09:40.000000000","message":"Default is already service_or_admin, so role:service mostly restores the working S3 path rather than adding hardening. For this note the point is a full off-switch (\"!\" on validate and create/get/list [see below]). You should assume existing EC2 credentials may be tainted and create denials on their own don’t expire them.\n\nFor new ec2 credentials, users would be blocked on adding those to keystone, before ever calling swift S3 APIs.\n\nThe recommendation is to turn the feature off (validate + create/get/list, or proxy-block), or accept the open issues until fixed code exists. There’s no middle mitigation worth recommending in the OSSN right now.","commit_id":"9bbd152a0c8d88c4725100b7e33338f679856b9e"}],"security-notes/OSSN-0112.yaml":[{"author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"change_message_id":"fdcb1e546b46217037474f8d7efd85633e1f9d68","unresolved":true,"context_lines":[{"line_number":2,"context_line":""},{"line_number":3,"context_line":"title: Keystone EC2-derived tokens retain full privileges"},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"date: \u00272026-10-09\u0027"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"affected-services: |"},{"line_number":8,"context_line":"  Keystone, all versions that expose ``POST /v3/ec2tokens`` /"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"5e8ff0d1_1168cb59","line":5,"range":{"start_line":5,"start_character":0,"end_line":5,"end_character":18},"updated":"2026-10-09 20:15:55.000000000","message":"same comment as 0111 on the date/timing: https://review.opendev.org/c/openstack/security-doc/+/1006742/comment/e17c6b1d_def9a090/","commit_id":"53e82298edfede28eea8ac6c6ec5fe7433628fe0"},{"author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"change_message_id":"fdcb1e546b46217037474f8d7efd85633e1f9d68","unresolved":true,"context_lines":[{"line_number":5,"context_line":"date: \u00272026-10-09\u0027"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"affected-services: |"},{"line_number":8,"context_line":"  Keystone, all versions that expose ``POST /v3/ec2tokens`` /"},{"line_number":9,"context_line":"  ``POST /v3/s3tokens``. On Keystone 30.0.0 and later, issuance is gated on"},{"line_number":10,"context_line":"  the ``ec2credential`` entry in ``[auth] methods`` and can be disabled by"},{"line_number":11,"context_line":"  omitting that method. On older releases the exchange endpoints are always"},{"line_number":12,"context_line":"  available when the API is reachable."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"summary: |"},{"line_number":15,"context_line":"  Tokens issued from EC2 credentials (``ec2credential``), used to support"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"8e599644_a6a6b376","line":12,"range":{"start_line":8,"start_character":0,"end_line":12,"end_character":38},"updated":"2026-10-09 20:15:55.000000000","message":"This explanation belongs in the summary below. Please state affected versions as a string:\n\n` \u003c30.0.1`\n\nor\n\n`\u003e1.0.0 \u003c30.0.1\u0027","commit_id":"53e82298edfede28eea8ac6c6ec5fe7433628fe0"},{"author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"change_message_id":"fdcb1e546b46217037474f8d7efd85633e1f9d68","unresolved":true,"context_lines":[{"line_number":27,"context_line":""},{"line_number":28,"context_line":"  **TL;DR -- risk if you keep using EC2/S3 credentials without the fixes:**"},{"line_number":29,"context_line":"  Treat every EC2 access/secret pair as equivalent to that user\u0027s password."},{"line_number":30,"context_line":"  Anyone who holds the pair (or can induce Swift\u0027s ``s3token`` middleware to"},{"line_number":31,"context_line":"  exchange a valid AWS signature) gets a token accepted by all OpenStack"},{"line_number":32,"context_line":"  APIs, not only object storage. Skipping the fixes below leaves concrete"},{"line_number":33,"context_line":"  gaps on top of that baseline: restricted application credentials can"},{"line_number":34,"context_line":"  widen to the user\u0027s full roles via OS-EC2 (bug 2167625, on releases"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"bdafcd1e_d01438bc","line":31,"range":{"start_line":30,"start_character":28,"end_line":31,"end_character":33},"updated":"2026-10-09 20:15:55.000000000","message":"what does this mean?\n\nCan a user do this? or are you expecting a compromised administrator?","commit_id":"53e82298edfede28eea8ac6c6ec5fe7433628fe0"},{"author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"change_message_id":"6c3ebf49683a248b3cdd274b96cf86cb145cd6e0","unresolved":false,"context_lines":[{"line_number":27,"context_line":""},{"line_number":28,"context_line":"  **TL;DR -- risk if you keep using EC2/S3 credentials without the fixes:**"},{"line_number":29,"context_line":"  Treat every EC2 access/secret pair as equivalent to that user\u0027s password."},{"line_number":30,"context_line":"  Anyone who holds the pair (or can induce Swift\u0027s ``s3token`` middleware to"},{"line_number":31,"context_line":"  exchange a valid AWS signature) gets a token accepted by all OpenStack"},{"line_number":32,"context_line":"  APIs, not only object storage. Skipping the fixes below leaves concrete"},{"line_number":33,"context_line":"  gaps on top of that baseline: restricted application credentials can"},{"line_number":34,"context_line":"  widen to the user\u0027s full roles via OS-EC2 (bug 2167625, on releases"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"779cca47_b49ec658","line":31,"range":{"start_line":30,"start_character":28,"end_line":31,"end_character":33},"in_reply_to":"bdafcd1e_d01438bc","updated":"2026-10-12 12:42:02.000000000","message":"It depends on the openstack version and patch level. In the original implementation, before our LLM-induced scans and fixes, any user could directly exchange for a keystone token. Right now it still generally holds true because you can call many APIs via either Swift or Heat. I removed the reference to swift here, since it\u0027s an internal detail that it doesn\u0027t produce a session token. Doing it via a service also has a different dynamic, since the token stays between services, but the effect is the same.","commit_id":"53e82298edfede28eea8ac6c6ec5fe7433628fe0"},{"author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"change_message_id":"fdcb1e546b46217037474f8d7efd85633e1f9d68","unresolved":true,"context_lines":[{"line_number":272,"context_line":"    (stable: 1009280 / 1009281 / 1009282)"},{"line_number":273,"context_line":""},{"line_number":274,"context_line":"credits:"},{"line_number":275,"context_line":"  - Sergey Kanibor"},{"line_number":276,"context_line":"  - Rock Xu"},{"line_number":277,"context_line":""},{"line_number":278,"context_line":"references:"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"95dbef97_c05fe2ab","line":275,"range":{"start_line":275,"start_character":4,"end_line":275,"end_character":18},"updated":"2026-10-09 20:15:55.000000000","message":"they prefer affiliation be listed: Luntry","commit_id":"53e82298edfede28eea8ac6c6ec5fe7433628fe0"},{"author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"change_message_id":"6c3ebf49683a248b3cdd274b96cf86cb145cd6e0","unresolved":false,"context_lines":[{"line_number":272,"context_line":"    (stable: 1009280 / 1009281 / 1009282)"},{"line_number":273,"context_line":""},{"line_number":274,"context_line":"credits:"},{"line_number":275,"context_line":"  - Sergey Kanibor"},{"line_number":276,"context_line":"  - Rock Xu"},{"line_number":277,"context_line":""},{"line_number":278,"context_line":"references:"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"fe1c0f8a_51757d3b","line":275,"range":{"start_line":275,"start_character":4,"end_line":275,"end_character":18},"in_reply_to":"95dbef97_c05fe2ab","updated":"2026-10-12 12:42:02.000000000","message":"Done","commit_id":"53e82298edfede28eea8ac6c6ec5fe7433628fe0"}]}