Executive brief
OpenStack Keystone, the identity service for OpenStack cloud environments, contains a flaw in how it handles application credentials. An attacker with access to a restricted set of credentials for one project can bypass security boundaries to create credentials for a different project. This allows for lateral movement across the cloud environment, potentially giving the attacker unauthorized access to data or resources in projects they should not be able to reach.
Technical details
An incorrect authorization vulnerability exists in OpenStack Keystone's 'POST /v3/credentials' endpoint. The service fails to validate that a user-supplied 'project_id' for an EC2-type credential matches the project scope of the authenticating application credential. An attacker possessing an unrestricted application credential for Project A can create an EC2 credential for Project B. When this EC2 credential is later exchanged via 'POST /v3/ec2tokens', Keystone issues a token scoped to Project B while retaining the original application credential ID, effectively bypassing project isolation. This exploit requires high privileges (an existing application credential) and often relies on a privileged service or gateway to perform the final token exchange. The issue is addressed in Keystone version 29.0.2 and related backports.
Affected products
- OpenStack Keystone >= 13.0.0, < 29.0.2
Timeline
- 2026-04-21: disclosed: Bug reported to Launchpad
- 2026-05-01: advisory: Initial GHSA and NVD publication
- 2026-05-28: patched: OpenStack Security Advisory OSSA-2026-015 released with patch details