In OpenStack Keystone versions prior to 29.0.3, any user authenticated with the role:reader can enumerate all project‑scoped role assignments across any domain by sending a GET request to /v3/role_assignments with include_subtree and specifying a domain ID in scope.project.id. Because the domain’s project record sets domain_id to null, the policy check that normally restricts this request passes for any caller, allowing the attacker to retrieve the names and home‑domain IDs of every user, group, project, and role involved. This information disclosure enables an attacker to map the entire role hierarchy of the cloud and potentially leverage it for further exploitation or privilege escalation.

The affected product is OpenStack Keystone; all releases before 29.0.3 are vulnerable. Users with a project level role:reader can trigger the flaw. No specific patch version is listed, but the CVE references Launchpad bug 2154645 for additional details.

The vulnerability carries a CVSS score of 7.1, indicating high severity. The EPSS score is not available, and it is not listed in the CISA KEV catalog. The attack vector is authenticated, with attackers needing the relatively common role:reader on any project. The likely exploitation path involves an attacker who has obtained reader access to a project sending a crafted HTTP request to the role assignment endpoint; the response leaks sensitive organizational information that could aid in planning further attacks. The lack of an EPSS score does not diminish the risk posed by the high CVSS rating and the ease of exploitation once the authenticated privilege is present.