Is CVE-2026-44394 actively exploited?

No active exploitation of CVE-2026-44394 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-44394 be exploited remotely?

Yes. CVE-2026-44394 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-44394?

CVE-2026-44394 has a CVSS score of 8.1 (HIGH).

HOME VULNERABILITIESCVE-2026-44394

HIGH

CVE-2026-44394

CWE-863Published: May 28, 2026· Updated: Jun 2, 2026

8.1

CVSS v3.1

EPSS:0.06%probability of exploitation in 30 daysPercentile:19.9th

Official Description

An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone federated token rescoping mechanism does not propagate the original token's expiry to the newly issued token. When a federated user rescopes a token via POST /v3/auth/tokens, the handle_scoped_token() function in the mapped authentication plugin returns response data without an expires_at value. The token provider falls back to issuing a token with a fresh default TTL. By rescoping repeatedly before each token expires, a user can maintain access indefinitely, bypassing operator-configured token lifetime policies. This is a variant of CVE-2012-3426. Only deployments using federated identity (SAML2, OpenID Connect) are affected.

NVD Source

Technical Analysis

CVE-2026-44394 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 8.1.