Executive brief
OpenStack Keystone, the identity service for OpenStack cloud environments, contains a flaw in how it handles application credentials. An authenticated user can trick the system into issuing a security token that belongs to a different user within the same project. This allows an attacker to impersonate colleagues, evade audit logs, and potentially escalate their privileges to administrative levels, gaining unauthorized control over shared cloud resources.
Technical details
An authorization bypass exists in the Keystone application credential authentication plugin. The 'POST /v3/auth/tokens' endpoint does not verify that the user specified in the authentication payload matches the actual owner of the application credential ID and secret provided. An authenticated attacker can provide their own valid application credential but specify a victim's username and domain in the request body. Keystone then issues a project-scoped token attributed to the victim. This impersonated token can be further abused to create trusts, enabling the attacker to escalate privileges (e.g., from member to admin) if the victim has higher roles. The issue is patched in versions 27.0.2, 28.0.2, and 29.0.2.
Affected products
- OpenStack Keystone >= 14.0.0, < 27.0.2; >= 28.0.0, < 28.0.2; >= 29.0.0, < 29.0.2
Timeline
- 2026-04-15: disclosed: Bug reported to OpenStack Launchpad
- 2026-05-28: advisory: OSSA-2026-015 published
- 2026-05-28: patched: Fixes released in multiple branches