)]}'
{"id":"openstack%2Fsecurity-doc~1002392","triplet_id":"openstack%2Fsecurity-doc~master~I33e4122d808aa6a8178737810305b93f2efcd956","project":"openstack/security-doc","branch":"master","attention_set":{"7973":{"account":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"last_update":"2026-08-25 21:29:25.000000000","reason":"Change was marked ready for review"},"14250":{"account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"last_update":"2026-08-27 17:07:30.000000000","reason":"\u003cGERRIT_ACCOUNT_10342\u003e replied on the change","reason_account":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"}}},"removed_from_attention_set":{"10342":{"account":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"last_update":"2026-08-27 17:07:30.000000000","reason":"\u003cGERRIT_ACCOUNT_10342\u003e replied on the change","reason_account":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"}}},"hashtags":[],"change_id":"I33e4122d808aa6a8178737810305b93f2efcd956","subject":"OSSN-0109: EC2-derived tokens retain full privileges","status":"NEW","created":"2026-08-25 20:58:32.000000000","updated":"2026-08-27 17:12:36.000000000","submit_type":"MERGE_IF_NECESSARY","mergeable":true,"submittable":false,"total_comment_count":7,"unresolved_comment_count":4,"has_review_started":true,"meta_rev_id":"054c4bb66761984c172a56035ecfaa67a66a086a","_number":1002392,"virtual_id_number":1002392,"owner":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"actions":{},"labels":{"Verified":{"recommended":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},{"tag":"autogenerated:zuul:check","value":1,"date":"2026-08-27 17:12:36.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","value":1,"default_value":0,"optional":true},"Code-Review":{"all":[{"value":0,"permitted_voting_range":{"min":-2,"max":2},"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"all":[{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"CC":[{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-08-25 21:00:05.000000000","updated_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"reviewer":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"state":"REVIEWER"},{"updated":"2026-08-25 21:06:11.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-08-25 21:12:28.000000000","updated_by":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"reviewer":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"state":"CC"}],"messages":[{"id":"9486f911eb65d3a65086313cbf854a9a50daf041","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-25 20:58:32.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"621fc2ae23c8dcf7d8cf130ae495bf841428b5c8","tag":"autogenerated:gerrit:setReadyForReview","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-25 20:59:57.000000000","message":"Set Ready For Review","accounts_in_message":[],"_revision_number":1},{"id":"9fa3ba1b047ddcd70615214bd35bd29e1c03613e","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-25 21:06:11.000000000","message":"Patch Set 1: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/bbb3ed48d4dc4a6fa32ac881fb064dc7\n\n- openstack-tox-linters https://zuul.opendev.org/t/openstack/build/4ba236391f57425a81a8dc0874820205 : FAILURE in 2m 40s\n- build-tox-manuals-publishdocs https://zuul.opendev.org/t/openstack/build/3857ec8ba60343678938eb6e68798e76 : SUCCESS in 1m 57s","accounts_in_message":[],"_revision_number":1},{"id":"114c195d10eba8b54f50db59241e527ec7aeb571","author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"date":"2026-08-25 21:12:28.000000000","message":"Patch Set 1:\n\n(1 comment)","accounts_in_message":[],"_revision_number":1},{"id":"5cf368f61004d03ef1d4e85e87fc57dc89ef4266","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-25 21:23:40.000000000","message":"Patch Set 1:\n\n(1 comment)","accounts_in_message":[],"_revision_number":1},{"id":"50849c3dc2052fed9f4494c1acbd306aa988e69d","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-25 21:25:29.000000000","message":"Uploaded patch set 2.\n\nOutdated Votes:\n* Verified-1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":2},{"id":"7dd83558155052a684b9522f232bb20c2d253da2","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-25 21:26:37.000000000","message":"Uploaded patch set 3.","accounts_in_message":[],"_revision_number":3},{"id":"59338d2b65c6a7c54b507ec529ebabdb798bfc0f","author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"date":"2026-08-25 21:28:52.000000000","message":"Patch Set 3:\n\n(1 comment)","accounts_in_message":[],"_revision_number":3},{"id":"c3830750ba6eb006e0e4ed4c5d2da3a0ac508aff","tag":"autogenerated:gerrit:setReadyForReview","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-25 21:29:25.000000000","message":"Set Ready For Review","accounts_in_message":[],"_revision_number":3},{"id":"a89cc264a90b5c8d31fd44eced30e4060f9c3126","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-25 21:38:39.000000000","message":"Patch Set 3: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/b3c75a1c1b46404ba6cc7a3d9f6fe5c3\n\n- openstack-tox-linters https://zuul.opendev.org/t/openstack/build/5d6dcbfc91404bf5b38ef753d4eeb34b : SUCCESS in 3m 24s\n- build-tox-manuals-publishdocs https://zuul.opendev.org/t/openstack/build/57c3cc95350944038fc3088066ccb004 : SUCCESS in 4m 42s","accounts_in_message":[],"_revision_number":3},{"id":"b38b22916fd4ffc8fefca3557e02a90cb954d08e","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-25 22:16:19.000000000","message":"Patch Set 3:\n\n(1 comment)","accounts_in_message":[],"_revision_number":3},{"id":"8bd1118d62751f39ef0912a2b5a8bc193fd469f4","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"date":"2026-08-27 17:03:38.000000000","message":"Uploaded patch set 4.\n\nOutdated Votes:\n* Verified+1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":4},{"id":"af7ff9a7f80f33cf6f1bb6eb13fb807e81ab44bc","author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"date":"2026-08-27 17:07:30.000000000","message":"Patch Set 4:\n\n(1 comment)","accounts_in_message":[],"_revision_number":4},{"id":"ccb0935b8d6045648603cf513036ec7f7c1f971d","author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"date":"2026-08-27 17:08:04.000000000","message":"Patch Set 4:\n\n(1 comment)","accounts_in_message":[],"_revision_number":4},{"id":"4586445faacc9a0f3d67b6c9ca2f00425c4a6242","author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"date":"2026-08-27 17:12:28.000000000","message":"Patch Set 4:\n\n(1 comment)","accounts_in_message":[],"_revision_number":4},{"id":"054c4bb66761984c172a56035ecfaa67a66a086a","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-27 17:12:36.000000000","message":"Patch Set 4: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/a286a0ee21384ce5aff329b00b694ff5\n\n- openstack-tox-linters https://zuul.opendev.org/t/openstack/build/37520f035e9e44f2aab0cd8381a2c715 : SUCCESS in 3m 01s\n- build-tox-manuals-publishdocs https://zuul.opendev.org/t/openstack/build/b8c59aa74e664acf84a9ccba1ebb8493 : SUCCESS in 3m 10s","accounts_in_message":[],"_revision_number":4}],"current_revision_number":4,"current_revision":"af299970498913f85406865450f45d763f914831","revisions":{"66b5810c03e12fa6677e0d0e8d5b0aaa14a3bc7a":{"kind":"REWORK","_number":1,"created":"2026-08-25 20:58:32.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/92/1002392/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/security-doc","ref":"refs/changes/92/1002392/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/92/1002392/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/92/1002392/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/92/1002392/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/security-doc refs/changes/92/1002392/1"}}},"commit":{"parents":[{"commit":"30a20af8acf2487d4758506b2235e5db1ce98559","subject":"OSSN-0108: Multiple authentication vulnerabilities in Ceph","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/30a20af8acf2487d4758506b2235e5db1ce98559"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 20:58:20.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 20:58:20.000000000","tz":120},"subject":"OSSN-0109: EC2-derived tokens retain full privileges","message":"OSSN-0109: EC2-derived tokens retain full privileges\n\nFixes for CVE-2026-2035364 (bug 2153453) and CVE-2026-2035366\n(bug 2158538) closed several places where Keystone\u0027s delegation\nchecks omitted ec2credential tokens alongside application\ncredentials, trusts, and OAuth1 access tokens. A related,\nnot-yet-merged fix closes two more (bug 2159643, bug 2158931) in\nthe generic /v3/credentials CRUD API.\n\nNone of these patches change the underlying design property that\nmakes this a recurring class of bug: an ec2credential-derived\ntoken is indistinguishable in privilege from a normal token once\nissued, and no OpenStack service other than Keystone inspects\ntoken.methods, so there is no supported way to restrict it to\nonly the EC2/S3-compatible endpoints it exists for. This note\ngives operators a policy.yaml-based way to disable the feature\nentirely for deployments that do not need it.\n\nAssisted-by: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e\nChange-Id: I33e4122d808aa6a8178737810305b93f2efcd956\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/66b5810c03e12fa6677e0d0e8d5b0aaa14a3bc7a"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/66b5810c03e12fa6677e0d0e8d5b0aaa14a3bc7a"}]},"branch":"refs/heads/master"},"7d554d33d8e576969c207dbdcda0532601c4e106":{"kind":"REWORK","_number":2,"created":"2026-08-25 21:25:29.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/92/1002392/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/security-doc","ref":"refs/changes/92/1002392/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/92/1002392/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/92/1002392/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/92/1002392/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/security-doc refs/changes/92/1002392/2"}}},"commit":{"parents":[{"commit":"30a20af8acf2487d4758506b2235e5db1ce98559","subject":"OSSN-0108: Multiple authentication vulnerabilities in Ceph","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/30a20af8acf2487d4758506b2235e5db1ce98559"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 20:58:20.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 21:25:23.000000000","tz":120},"subject":"OSSN-0109: EC2-derived tokens retain full privileges","message":"OSSN-0109: EC2-derived tokens retain full privileges\n\nFixes for CVE-2026-2035364 (bug 2153453) and CVE-2026-2035366\n(bug 2158538) closed several places where Keystone\u0027s delegation\nchecks omitted ec2credential tokens alongside application\ncredentials, trusts, and OAuth1 access tokens. A related,\nnot-yet-merged fix closes two more (bug 2159643, bug 2158931) in\nthe generic /v3/credentials CRUD API.\n\nNone of these patches change the underlying design property that\nmakes this a recurring class of bug: an ec2credential-derived\ntoken is indistinguishable in privilege from a normal token once\nissued, and no OpenStack service other than Keystone inspects\ntoken.methods, so there is no supported way to restrict it to\nonly the EC2/S3-compatible endpoints it exists for. This note\ngives operators a policy.yaml-based way to disable the feature\nentirely for deployments that do not need it.\n\nAssisted-by: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e\nChange-Id: I33e4122d808aa6a8178737810305b93f2efcd956\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/7d554d33d8e576969c207dbdcda0532601c4e106"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/7d554d33d8e576969c207dbdcda0532601c4e106"}]},"branch":"refs/heads/master"},"9e153b5db2bb8496aa848136cd7f7ffb9e6cfe13":{"kind":"REWORK","_number":3,"created":"2026-08-25 21:26:37.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/92/1002392/3","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/security-doc","ref":"refs/changes/92/1002392/3","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/92/1002392/3 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/92/1002392/3 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/92/1002392/3 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/security-doc refs/changes/92/1002392/3"}}},"commit":{"parents":[{"commit":"30a20af8acf2487d4758506b2235e5db1ce98559","subject":"OSSN-0108: Multiple authentication vulnerabilities in Ceph","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/30a20af8acf2487d4758506b2235e5db1ce98559"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 20:58:20.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 21:26:32.000000000","tz":120},"subject":"OSSN-0109: EC2-derived tokens retain full privileges","message":"OSSN-0109: EC2-derived tokens retain full privileges\n\nFixes for CVE-2026-2035364 (bug 2153453) and CVE-2026-2035366\n(bug 2158538) closed several places where Keystone\u0027s delegation\nchecks omitted ec2credential tokens alongside application\ncredentials, trusts, and OAuth1 access tokens. A related,\nnot-yet-merged fix closes two more (bug 2159643, bug 2158931) in\nthe generic /v3/credentials CRUD API.\n\nNone of these patches change the underlying design property that\nmakes this a recurring class of bug: an ec2credential-derived\ntoken is indistinguishable in privilege from a normal token once\nissued, and no OpenStack service other than Keystone inspects\ntoken.methods, so there is no supported way to restrict it to\nonly the EC2/S3-compatible endpoints it exists for. This note\ngives operators a policy.yaml-based way to disable the feature\nentirely for deployments that do not need it.\n\nAssisted-by: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e\nChange-Id: I33e4122d808aa6a8178737810305b93f2efcd956\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/9e153b5db2bb8496aa848136cd7f7ffb9e6cfe13"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/9e153b5db2bb8496aa848136cd7f7ffb9e6cfe13"}]},"branch":"refs/heads/master"},"af299970498913f85406865450f45d763f914831":{"kind":"REWORK","_number":4,"created":"2026-08-27 17:03:38.000000000","uploader":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"ref":"refs/changes/92/1002392/4","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/security-doc","ref":"refs/changes/92/1002392/4","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/92/1002392/4 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/92/1002392/4 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/security-doc refs/changes/92/1002392/4 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/security-doc refs/changes/92/1002392/4"}}},"commit":{"parents":[{"commit":"e08e4734ad7013adf6cffc3d7e45bb94ab0d4525","subject":"Merge \"Migrate OSSN txt files to build pipeline\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/e08e4734ad7013adf6cffc3d7e45bb94ab0d4525"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 20:58:20.000000000","tz":120},"committer":{"name":"Jay Faulkner","email":"jay@jvf.cc","date":"2026-08-27 17:03:14.000000000","tz":-420},"subject":"OSSN-0109: EC2-derived tokens retain full privileges","message":"OSSN-0109: EC2-derived tokens retain full privileges\n\nFixes for CVE-2026-2035364 (bug 2153453) and CVE-2026-2035366\n(bug 2158538) closed several places where Keystone\u0027s delegation\nchecks omitted ec2credential tokens alongside application\ncredentials, trusts, and OAuth1 access tokens. A related,\nnot-yet-merged fix closes two more (bug 2159643, bug 2158931) in\nthe generic /v3/credentials CRUD API.\n\nNone of these patches change the underlying design property that\nmakes this a recurring class of bug: an ec2credential-derived\ntoken is indistinguishable in privilege from a normal token once\nissued, and no OpenStack service other than Keystone inspects\ntoken.methods, so there is no supported way to restrict it to\nonly the EC2/S3-compatible endpoints it exists for. This note\ngives operators a policy.yaml-based way to disable the feature\nentirely for deployments that do not need it.\n\nAssisted-by: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e, Claude Opus 5\nChange-Id: I33e4122d808aa6a8178737810305b93f2efcd956\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\nSigned-off-by: Jay Faulkner \u003cjay@jvf.cc\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/af299970498913f85406865450f45d763f914831"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/security-doc/commit/af299970498913f85406865450f45d763f914831"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"OK","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY"},{"label":"Workflow","status":"MAY"}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Verified\u003dMAX","label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Code-Review\u003dMAX","label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Workflow\u003dMAX","label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}