CVE-2026-42998: OpenStack Keystone Application Credential Authentication Bypass

Technical summary

CVE-2026-42998 exploits insufficient authorization checks in Keystone's application credential authentication flow. When a user authenticates using an application credential (ID and secret), Keystone does not verify that the requesting principal owns that credential. An attacker can supply their own application credential's ID and secret, then specify an arbitrary victim's username and domain in the request body. Keystone incorrectly issues a token scoped to the victim's account. The resulting token's role set is the intersection of the application credential's roles and the victim's project roles, which limits but does not prevent abuse. The vulnerability is classified as CWE-863 (Improper Authorization) and affects versions before 29.0.2.

Business impact

This vulnerability creates identity confusion at the authentication layer, enabling attackers to evade audit controls and access victim data or perform actions as another user within shared project boundaries. In multi-tenant environments where application credentials are used for service-to-service or programmatic access, an internal actor or compromised service account could impersonate legitimate users, read their credentials, modify shared resources, or perform actions that appear in audit logs under the victim's identity. The impact is particularly severe in organizations relying on audit trails for compliance or incident investigation, as the attacker's activities would be attributed to the victim.

Affected systems

OpenStack Keystone deployments running versions prior to 29.0.2 are affected. Keystone is the identity service component in OpenStack clouds, so any OpenStack installation using a vulnerable version is at risk. The vulnerability is most exploitable in environments where application credentials are widely distributed or used by multiple services, and where users share projects. Deployments using only personal user credentials (and not application credentials for authentication) have reduced exposure but are still technically vulnerable if any application credential is present.

Exploitability

The vulnerability requires an attacker to already possess a valid application credential (ID and secret). This means the threat is primarily from internal actors, compromised service accounts, or scenarios where application credentials have been leaked. The attacker does not need special privileges—any authenticated user with an application credential can attempt impersonation. No user interaction is required, and the attack is remotely exploitable over the network. However, the attacker can only impersonate users within projects they already have access to, and the resulting token's permissions are constrained by role intersection. The attack is straightforward once a credential is obtained, making it a high-probability exploit path for insiders or compromised accounts.

Remediation

Upgrade OpenStack Keystone to version 29.0.2 or later. This patch adds proper ownership validation to the application credential authentication flow, ensuring that only the credential's owner can authenticate using that credential. Organizations should prioritize this upgrade for Keystone services that support multi-user or multi-tenant access patterns. Verify the patch level against your vendor advisory before deployment. Additionally, review application credential usage policies: limit the number of application credentials issued, enforce credential rotation schedules, and implement network segmentation to reduce the blast radius of a compromised credential.

Patch guidance

Apply the Keystone 29.0.2 update or later as soon as feasible. Verify compatibility with your OpenStack distribution and other dependent services before deploying to production. The patch should be applied to all Keystone instances in your deployment, including redundant or load-balanced configurations. Test the upgrade in a staging environment to confirm that existing application credential workflows continue to function. After patching, conduct a review of recent authentication logs to identify any suspicious impersonation attempts that may have occurred prior to the fix.

Detection guidance

Monitor Keystone authentication logs for anomalies: look for successful token issuance events where the authenticated user differs from the requesting client's expected identity, particularly when application credentials are involved. Search for patterns where a single application credential is used to obtain tokens for multiple distinct user identities, especially across different projects or domains. Review audit trails for actions attributed to users that do not align with their typical behavior or access patterns. Enable detailed logging in Keystone if not already active, and correlate authentication events with subsequent API calls to identify impersonation chains. Examine application credential usage: identify which services or users hold credentials, and cross-reference with unexpected authentication patterns.

Why prioritize this

This vulnerability merits prompt attention because it directly undermines authentication integrity in identity systems. Although the CVSS score is moderate (6.0), the nature of the flaw—identity spoofing with audit trail poisoning—has disproportionate business and compliance impact. The fix is available and straightforward to deploy. Organizations in regulated industries or with strict audit requirements should treat this as high-priority. The vulnerability is not yet in the CISA KEV catalog, but its functional severity warrants defensive action regardless.

Risk score, explained

The CVSS 3.1 score of 6.0 (MEDIUM) reflects the requirement that an attacker must already possess a valid application credential, reducing the attack surface compared to unauthenticated exploits. However, the scope is marked as changed because the attack crosses trust boundaries—the attacker impersonates another user—and the impact touches confidentiality (reading victim credentials), integrity (acting as the victim), and availability (audit log integrity). The score does not fully capture the compliance and audit trail implications, which may justify a higher organizational risk rating despite the moderate CVE score.

Frequently asked questions