CVE-2026-43000: OpenStack Keystone Privilege Escalation via Application Credential Impersonation

Technical summary

The vulnerability arises from a logic flaw in Keystone's trust delegation mechanism when combined with application credential impersonation. Specifically, during trust creation, Keystone validates delegated roles by querying the victim's actual role assignments in the database (via the trustor identity carried in the impersonated token) rather than enforcing role constraints based on the requesting token's capabilities. This violates the principle of least privilege: an attacker with only member role can craft an application credential impersonation that generates a token appearing to come from a high-privileged user, then exploit the trust validation logic to formally delegate that user's admin role back to themselves. The trust object persists independently of the initial impersonation, enabling sustained access even if the application credential is later revoked. Affected versions are OpenStack Keystone prior to 29.0.2.

Business impact

Successful exploitation enables unauthorized administrative access to an OpenStack environment. An insider or an attacker who has compromised a low-privilege account can gain full control over identity, access, and resource management within the cloud platform. This includes the ability to create additional backdoors, modify permissions, access sensitive data, and disrupt services. The attack is particularly dangerous because audit logs record actions under the victim's identity, potentially masking the intrusion and complicating incident response. Organizations relying on role-based access control (RBAC) as a security boundary within OpenStack will be circumvented.

Affected systems

OpenStack Keystone deployments running versions before 29.0.2 are vulnerable. The attack requires the attacker to have at least member-level role assignment on any project. Keystone is the identity service used by all OpenStack clouds, so any organization using OpenStack for infrastructure-as-a-service (IaaS) is potentially affected. The vulnerability does not require external network access to Keystone APIs—it only requires existing authentication within the platform, making it a lateral escalation threat in multi-tenant or hybrid cloud environments.

Exploitability

This vulnerability requires an authenticated user with member-level project permissions, making it a privilege escalation rather than a zero-day. The CVSS score of 6.0 (MEDIUM) reflects the authentication prerequisite (PR:L) and moderate complexity (AC:H). However, the practical exploitability is significant in environments where: (1) service accounts or application credentials with member role are provisioned, (2) developers or contractors have member access to shared projects, or (3) an attacker has already obtained low-privilege credentials through phishing or lateral movement. The attack does not require user interaction and succeeds silently. No public exploit code is known to be in active use, and the vulnerability is not on the CISA Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Upgrade OpenStack Keystone to version 29.0.2 or later. This patch corrects the trust validation logic to enforce role constraints based on the requesting token's actual capabilities, preventing members from delegating roles they do not possess. Organizations unable to patch immediately should implement compensating controls: restrict application credential creation to trusted administrators, audit trust and credential creation events regularly, and enforce additional MFA for administrative API operations. Monitor for suspicious trust creation patterns, particularly those delegating admin roles from lower-privileged users.

Patch guidance

Verify your Keystone version by checking the deployed release or querying the version endpoint. Keystone versions released before 29.0.2 require patching. Consult your OpenStack distribution (Red Hat OpenStack Platform, Ubuntu OpenStack, etc.) for patch availability and timing. Patches should be deployed in a maintenance window; coordinate with infrastructure teams to avoid service disruption. After patching, validate that trust delegation enforcement is active by testing that a member-role user cannot create trusts delegating admin privileges.

Detection guidance

Monitor Keystone audit logs (typically via oslo.log or external SIEM integration) for: (1) application credential creation by low-privilege users, (2) trust creation events where the delegated role (admin) exceeds the requesting user's role (member), (3) audit entries showing actions performed under a high-privileged user's identity that do not align with that user's normal activity patterns. Implement alerting on trust creation involving sensitive roles. Query the Keystone database directly to identify orphaned or unexpected trusts. In a SIEM, correlate multiple application credential and trust events from the same user over a short timespan as a potential chain attack.

Why prioritize this

Prioritize this patch in environments where: (1) OpenStack Keystone is internet-facing or accessible to untrusted networks, (2) shared projects with many users exist, (3) service accounts are provisioned with member role, or (4) regulatory compliance requires strict segregation of administrative access. While the vulnerability requires prior authentication, its ability to silently escalate member-level access to admin, combined with audit trail obfuscation, makes it a high-priority lateral movement risk. Organizations with strong insider threat programs or defense-in-depth controls may rate it slightly lower, but it should not be deferred indefinitely.

Risk score, explained

CVSS 6.0 (MEDIUM) reflects: Network-based attack vector (AV:N), high complexity due to the need to chain two separate features correctly (AC:H), requirement for low-privilege authentication (PR:L), scope change as the attacker can affect other users' resources (S:C), and partial impact on confidentiality, integrity, and availability (C:L/I:L/A:L). The MEDIUM rating does not fully capture the severity of unconstrained privilege escalation in identity infrastructure; however, CVSS penalties for authentication requirement and attack complexity are appropriate. Security leaders should treat this as a HIGH priority within their OpenStack estate due to the attack's stealth, lateral movement implications, and cloud platform criticality.

Frequently asked questions