OpenStack Keystone versions prior to 29.0.3 allow an authenticated user who holds the role:reader on any project to enumerate every project‑scoped role assignment across any domain by sending a GET request to /v3/role_assignments with the query parameters include_subtree and optionally include_names. The query parameter scope.project.id is interpreted as a domain ID; because the project record has domain_id set to null, the policy check that normally validates the caller's domain is bypassed, causing the endpoint to return all role assignments. With include_names the response discloses the names and home‑domain IDs of all users, groups, projects, and roles involved. This means an attacker can harvest domain IDs from the response and repeat the query, mapping role assignments across the entire cloud. The flaw is driven by a misuse of a None value in the internal helper function list_role_assignments_for_tree.

The vulnerability affects OpenStack Keystone. All releases before version 29.0.3 are vulnerable when a user possesses the role:reader on a project; the flaw does not require elevated privileges beyond that. Even deployments that use the default bootstrap domain are susceptible because the literal domain ID "default" always triggers the bypass. The affected component is the GET /v3/role_assignments endpoint, and the error mode can be triggered by supplying include_subtree and, if desired, include_names in the request.

The CVSS score of 7.1 classifies the bug as high severity. The EPSS score of less than 1% indicates a very low observed exploitation probability at present. The vulnerability is not listed in the CISA KEV catalog. Attackers need only have legitimate access to a project with the role:reader; they must supply crafted query parameters to the role assignment endpoint. Once they obtain the response, they can map every user's domain and role structure, which can aid in planning further compromise or privilege escalation. The primary risk is stealthy information gathering across the cloud.