OpenStack Keystone versions prior to 29.0.2 contain an authorization bypass vulnerability (CWE-863) in the POST /v3/credentials API endpoint. The service fails to verify that the project_id provided for an EC2-type credential matches the project associated with the authenticating application credential. An attacker possessing an unrestricted application credential scoped to project A can create EC2 credentials targeting project B. Subsequently, exchanging these EC2 credentials for a Keystone token results in a token scoped to project B but still linked to the original application credential ID. This enables unauthorized cross-project lateral movement within the scope of the attacker's roles, potentially allowing actions in project B that the attacker is permitted in project A. The vulnerability affects multi-tenant isolation and can lead to significant confidentiality, integrity, and availability impacts depending on role privileges. The vulnerability is tracked as CVE-2026-43001 with a CVSS v3.1 score of 7.9 (high severity).

This vulnerability allows attackers with unrestricted application credentials to bypass project isolation in OpenStack Keystone, enabling unauthorized access to other projects within the same deployment. The attacker can perform actions in the targeted project with the same permissions they have in their original project, leading to potential compromise of confidentiality, integrity, and availability of resources across projects. This lateral movement undermines multi-tenant security controls in OpenStack environments.

A patch is available for this vulnerability. Vendors managing cloud-hosted OpenStack Keystone services typically apply fixes server-side. Administrators should ensure application credentials are scoped with the least privilege necessary. If EC2 credentials are not used, consider disabling the EC2 credential API endpoint in Keystone to prevent unauthorized cross-project credential creation. Refer to the OpenStack Keystone administration guide for detailed instructions. Applying the official vendor patches and configuration changes is recommended to fully remediate this issue.