Executive brief
OpenStack Keystone, the identity service for OpenStack cloud environments, contains a vulnerability that allows a standard user to escalate their privileges to an administrator. By exploiting a flaw in how credentials and 'trusts' are handled, an attacker can impersonate another user and grant themselves administrative access to a project. This could lead to unauthorized access to sensitive cloud resources, data theft, or service disruption, while making the malicious actions appear as if they were performed by the victim.
Technical details
An incorrect authorization issue exists in OpenStack Keystone's handling of application credentials and trusts. When an attacker uses an impersonated token (obtained via a separate credential impersonation flaw) to create a Keystone trust, the system correctly identifies the victim as the trustor but fails to validate delegated roles against the requesting token's scope. Instead, Keystone validates the roles against the victim's actual database assignments. This allows an attacker with a 'member' role to create a trust delegating the victim's 'admin' role to themselves. The resulting trust is persistent and allows the attacker to maintain administrative access even if the original credentials are revoked. The attack requires network access and valid low-privileged credentials on a project shared with the victim.
Affected products
- OpenStack Keystone >= 14.0.0, < 27.0.2; >= 28.0.0, < 28.0.2; >= 29.0.0, < 29.0.2
- Red Hat Red Hat OpenStack Platform 13 (Queens)
- Red Hat Red Hat OpenStack Platform 16.2
- Red Hat Red Hat OpenStack Platform 17.1
- Red Hat Red Hat OpenStack Platform 18.0
Timeline
- 2026-04-15: disclosed: Bug reported to OpenStack Launchpad
- 2026-05-28: advisory: Initial GHSA and NVD publication
- 2026-07-02: patched: Advisory updated with patched versions 27.0.2, 28.0.2, and 29.0.2