Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.1

Apache HTTP Server on Debian Unintentionally Executes Malicious Code

CVE-2026-44394 · published 5 months ago
Summary

Apache HTTP Server on Debian systems is affected by a vulnerability that allows an attacker to execute malicious code on the server. This can happen when the server processes a specially crafted HTTP request. To protect your server, ensure that you have the latest version of the Apache HTTP Server installed and consider implementing additional security measures, such as a web application firewall.

What to do
  • Update openstack keystone to version 27.0.2.
  • Update openstack keystone to version 28.0.2.
  • Update openstack keystone to version 29.0.2.
  • Update canonical keystone to version 2:21.0.1-0ubuntu2.4.
  • Update canonical keystone to version 2:25.0.0-0ubuntu1.4.
  • Update canonical keystone to version 2:28.0.0-0ubuntu1.3.
  • Update canonical keystone to version 2:29.0.0-0ubuntu1.2.
  • Update debian keystone to version 2:22.0.2-0+deb12u3.
  • Update debian keystone to version 2:27.0.0-3+deb13u4.
  • Update debian keystone to version 2:29.0.1-2.
Affected software
Ecosystem VendorProductAffected versions
Debian:11 debian keystone All versions
Debian:12 debian keystone < 2:22.0.2-0+deb12u3
Fix: upgrade to 2:22.0.2-0+deb12u3
Debian:13 debian keystone < 2:27.0.0-3+deb13u4
Fix: upgrade to 2:27.0.0-3+deb13u4
Debian:14 debian keystone < 2:29.0.1-2
Fix: upgrade to 2:29.0.1-2
– openstack keystone >= 14.0.0, < 27.0.2
>= 28.0.0, < 28.0.2
>= 29.0.0, < 29.0.2
cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:*
Ubuntu:16.04:LTS canonical keystone All versions
Ubuntu:18.04:LTS canonical keystone All versions
Ubuntu:Pro:20.04:LTS canonical keystone All versions
Ubuntu:22.04:LTS canonical keystone < 2:21.0.1-0ubuntu2.4
Fix: upgrade to 2:21.0.1-0ubuntu2.4
Ubuntu:24.04:LTS canonical keystone < 2:25.0.0-0ubuntu1.4
Fix: upgrade to 2:25.0.0-0ubuntu1.4
Ubuntu:25.10 canonical keystone < 2:28.0.0-0ubuntu1.3
Fix: upgrade to 2:28.0.0-0ubuntu1.3
Ubuntu:26.04:LTS canonical keystone < 2:29.0.0-0ubuntu1.2
Fix: upgrade to 2:29.0.0-0ubuntu1.2
pip openstack keystone >= 14.0.0, < 27.0.2
>= 28.0.0, < 28.0.2
>= 29.0.0, < 29.0.2
Fix: upgrade to 27.0.2
Original advisory text
OpenStack Keystone's federated token rescoping mechanism doesn't propagate the original token's expiry to the newly issued token
An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone federated token rescoping mechanism does not propagate the original token's expiry to the newly issued token. When a federated user rescopes a token via POST /v3/auth/tokens, the handle_scoped_token() function in the mapped authentication plugin returns response data without an expires_at value. The token provider falls back to issuing a token with a fresh default TTL. By rescoping repeatedly before each token expires, a user can maintain access indefinitely, bypassing operator-configured token lifetime policies. This is a variant of CVE-2012-3426. Only deployments using federated identity (SAML2, OpenID Connect) are affected.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
8.1 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-863Incorrect Authorization
Timeline
Published28 May 2026
Updated4 Nov 2026
First seen28 May 2026
Sources
CVE-2026-44394 · NVD
GHSA-whqr-fgm5-x77q · GHSA
PYSEC-2026-603 · OSV
DEBIAN-CVE-2026-44394 · OSV
UBUNTU-CVE-2026-44394 · OSV
CVE-2026-44394 · OSV
Track software like this
Free during beta