CVE-2026-43001

Executive Summary

CVE-2026-43001 is an authorization bypass vulnerability in OpenStack Keystone, affecting versions 13 through 29. The flaw resides in the credential creation endpoint (POST /v3/credentials), where the project_id supplied by the caller for an EC2-type credential is not cross-validated against the authenticating application credential's project scope. An attacker holding an unrestricted application credential for project A can create EC2 credentials targeting project B, and subsequently exchange them via POST /v3/ec2tokens to receive a token scoped to project B, enabling cross-project lateral movement within the credential owner's existing role permissions. With a CVSS score of 7.9 (High), this vulnerability poses a significant risk to multi-tenant OpenStack environments, particularly those with distributed application credentials across projects.

Technical Analysis

The vulnerability stems from a missing authorization check in the Keystone identity service's credential management API. When a user authenticates with an application credential (a scoped, long-lived token with restricted permissions), the system verifies the caller's ability to act on the credential's root user's behalf. However, during the creation of EC2-style credentials (access key/secret pair), the controller accepts a project_id attribute in the request body without verifying that it matches the project associated with the application credential used for authentication.

From a code perspective, the flaw exists in the CredentialsController's create method. The handler retrieves the authenticated context, extracts the app_cred_id (application credential ID) from the token, and resolves the associated project from the token's scope. However, when constructing the credential object, it trusts the user-supplied project_id in the JSON payload rather than overriding it with the authenticated project context. This results in a credential record stored with a foreign project reference — no foreign key constraint exists to prevent this, as Keystone uses a soft-referencing model for project IDs.

The attack surface is the Keystone V3 REST API, specifically:

• POST /v3/credentials — where the malicious credential is created
• POST /v3/ec2tokens — where the forged EC2 credential is exchanged for a token

The vulnerability is a classic instance of CWE-639 (Authorization Bypass Through User-Controlled Key). The missing validation is purely a server-side trust issue: the API should derive the project from the authenticated application credential's scope, but instead honors the unverified payload field. Notably, the flaw only affects EC2-type credentials; other credential types (e.g., simple certificates or application credentials) inherit the authenticated project implicitly.

The token issued via the ec2tokens exchange retains the original app_cred_id in its properties. This is significant because the application credential's role assignments (usually owner or admin roles on the root user) are propagated to the new token. If the attacker's user has elevated roles in project B through group membership or a domain-scoped role, the forged token inherits those, expanding the blast radius even if the attacker did not have explicit access to project B's credentials.

Exploitation Scenarios

The following is a step-by-step attack chain leveraging CVE-2026-43001. This assumes the attacker already possesses a valid unrestricted application credential for project A (e.g., obtained through phishing, leaked secrets, or a compromised service account).

Step 1 — Reconnaissance (Project Enumeration): The attacker first enumerates accessible project IDs. Since they have a valid application credential, they can call GET /v3/projects with the domain_id filter. If this returns a 403 (because the app cred lacks project-list permission), they can instead brute-force or guess UUIDs. Keystone project IDs are UUIDv4, but in many deployments, they follow predictable patterns (e.g., sequential or derived from a seed). Alternatively, if the attacker has any prior knowledge of the environment (e.g., a leaked cloud-config or heat template), they can extract target project IDs from those artifacts.

Step 2 — Credential Creation (Weaponization): The attacker crafts a POST request to https://<keystone-endpoint>/v3/credentials with the following JSON body:

{
  "credential": {
    "type": "ec2",
    "user_id": "<target_user_id>",
    "project_id": "<target_project_B_uuid>",
    "blob": "{\"access\":\"AKIAFAKE...\",\"secret\":\"generated_secret\"}"
  }
}

They authenticate using their possessed application credential ID and secret via the Authorization: Bearer <app_cred_token> header or by first obtaining a Keystone token with the app cred. The server accepts this request because it does not validate the project_id in the body against the app cred's project.

Step 3 — Token Exchange (Execution): The attacker exchanges the forged EC2 credential for a scoped token by sending a POST to /v3/ec2tokens:

curl -X POST https://<keystone>/v3/ec2tokens \
  -H "Content-Type: application/json" \
  -d '{
        "auth": {
          "identity": {
            "methods": ["ec2"],
            "ec2": {
              "access": "AKIAFAKE...",
              "secret": "generated_secret",
              "project_id": "<target_project_B_uuid>"
            }
          }
        }
      }'

The response contains a Keystone token (in headers or body) scoped to project B. This token carries the full role footprint of the original user (the app_cred owner), including any domain-admin or project-admin roles that user possesses in project B.

Step 4 — Lateral Movement (Post-Exploitation): With the forged token, the attacker now performs operations in project B:

• POST /v3/auth/tokens to validate and check the token's roles.
• Call project B's compute API (POST /v2.1/servers) to spin up instances — potentially using images that will be injected with backdoors.
• Access project B's object storage (GET /v1/AUTH_<project_b>/) or block storage snapshots.
• If the attacker's user has admin role in project B (via group membership), they can create additional credentials for other users, escalate privileges, or delete infrastructure.

Step 5 — Persistence & Evasion: The attacker can create multiple EC2 credentials for project B, ensuring redundant access. Because the original app_cred_id is signed into the token, audit logs will show the originating app credential, but the project scope will be inconsistent — a potential detection gap if monitoring is not tuned to flag this misalignment.

Note on Preconditions: This attack requires the attacker to have an unrestricted application credential. Unrestricted app creds have "unrestricted": true and inherit all roles of the user. Restricted app creds (default) only carry explicitly assigned roles and thus limit the blast radius. This is a parenthetical caveat — the vulnerability class is fully exploitable by any holder of an unrestricted app cred. No public PoC exists, but the API interaction is trivially reproducible with standard curl commands.

Impact Assessment

CVSS Subscore Analysis (Score: 7.9 High):

• Attack Vector (AV:N) — Network: The vulnerability is fully exploitable over the network via HTTPS.
• Attack Complexity (AC:L) — Low: No special conditions beyond possessing an application credential; the API is straightforward.
• Privileges Required (PR:L) — Low: Requires a valid application credential, which is a low-privileged state compared to a full admin token.
• User Interaction (UI:N) — None: No victim interaction needed.
• Scope (S:U) — Unchanged: The authorization breach stays within the Keystone domain's security boundary.
• Confidentiality (C:H) — High: Attacker can access resources and data in a foreign project, potentially exposing secrets, VM images, and object storage.
• Integrity (I:H) — High: Attacker can create, modify, or delete resources in project B, including spinning up instances or altering configurations.
• Availability (A:L) — Low: While not a direct DoS vector, the attacker could intentionally misconfigure or terminate resources in project B, causing limited disruption.

Business Impact: For multi-tenant OpenStack clouds (public clouds, enterprise private clouds, managed service providers), this vulnerability breaks the foundational tenant isolation model. Keystone is the identity and authorization backbone; any flaw here undermines trust in the entire platform. The practical impact scales with the roles of the compromised user. If the attacker's user is a cloud-admin or domain-admin, they could move across all projects in a domain, potentially achieving full cloud compromise.

Blast Radius:

• Affected Versions: Keystone 13 through 29 — this spans several major releases, meaning most actively deployed Keystone instances in the wild are likely vulnerable unless patched.
• Data Exposure: EC2 credentials often map to S3-compatible object storage. A forged credential for project B could grant access to project B's containers and objects.
• Credential Reuse: The forged EC2 credential can be converted to a Keystone token with full project scope, which then can be used to create additional app creds or tokens for other projects, creating a spiderweb of compromised access.

Detection Guidance

Sigma Rule

title: OpenStack Keystone EC2 Credential Project Mismatch Attempt
id: 5f2a7d91-b3c4-4e2f-9a8c-2d1e0f3a6b87
status: experimental
description: Detects attempts to create EC2 credentials where the supplied project_id differs from the authenticated application credential's project scope, indicating CVE-2026-43001 exploitation.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-43001
    - https://security.openstack.org/ossa/OSSA-2026-001.html
author: Valtersit SOC
date: 2026/02/15
logsource:
    category: application
    product: openstack
    service: keystone
detection:
    selection:
        event_type: credential.create
        credential_type: ec2
    filter_benign:
        request_path: /v3/credentials
        body.project_id:
            - NOT_EQUALS: null
    condition: selection and filter_benign and not (body.project_id in same-session-project)
falsepositives:
    - Legitimate cross-project EC2 credential creation via admin API by an admin token (rare, but possible if organizations deliberately create cross-project creds)
    - Misconfigured automation scripts that deliberately set project_id
level: high
tags:
    - attack.t1190
    - cve.2026.43001

YARA Rule

rule OpenStack_Keystone_CVE_2026_43001_EC2_Cred_Creation
{
    meta:
        author = "Valtersit SOC"
        description = "Detects HTTP request bodies attempting to create EC2 credentials with a project_id field in Keystone API"
        cve = "CVE-2026-43001"
        date = "2026-02-15"
        severity = "high"
    strings:
        $endpoint = "/v3/credentials" ascii wide
        $type_ec2 = "\"type\":\"ec2\"" ascii wide
        $type_ec2_spaced = "\"type\" : \"ec2\"" ascii wide
        $project_id = "\"project_id\"" ascii wide
        $blob = "\"blob\"" ascii wide
        $access_key = "\"access\"" ascii wide
        $secret_key = "\"secret\"" ascii wide
    condition:
        uint16(0) == 0x0d0a or uint32(0) == 0x0a0d0a0d or filesize < 10KB
        and any of ($endpoint*) and any of ($type_ec2*) and any of ($project_id*) 
        and any of ($blob*) and (any of ($access_key*) or any of ($secret_key*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET EXPLOIT OpenStack Keystone EC2 Credential Project Mismatch (CVE-2026-43001)"; flow:to_server,established; content:"POST"; http_method; content:"/v3/credentials"; http_uri; content:"\"type\":\"ec2\""; http_client_body; content:"\"project_id\""; http_client_body; pcre:"/\"project_id\"\s*:\s*\"[a-f0-9-]{36}\"[\s\S]*\"blob\"/Ui"; reference:cve,2026-43001; reference:url,security.openstack.org; classtype:attempted-user; sid:202643001; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where http_request.method == "POST" and http_request.uri == "/v3/credentials" and 
   http_request.body : "*\"type\":\"ec2\"*" and http_request.body : "*\"project_id\"*"]
  [network where http_request.method == "POST" and http_request.uri == "/v3/ec2tokens" and 
   http_request.body : "*\"access\"*" and http_request.body : "*\"secret\"*"]

Splunk SPL Query

index=openstack sourcetype="keystone:api"
| where method="POST" AND uri="/v3/credentials"
| spath input=request_body path=credential.type output=cred_type
| spath input=request_body path=credential.project_id output=requested_project
| spath input=request_body path=credential.blob output=cred_blob
| search cred_type="ec2" AND requested_project=*
| table _time, source_ip, auth_token.user_id, auth_token.project_id, requested_project, cred_blob
| eval is_mismatch = if(auth_token.project_id != requested_project, "YES", "NO")
| search is_mismatch="YES"
| stats count by source_ip, auth_token.user_id, auth_token.project_id, requested_project

Wazuh OSSEC Rule

<group name="openstack,">
    <rule id="202643" level="10">
        <decoded_as>json</decoded_as>
        <field name="event_type">credential.create</field>
        <field name="credential.type">ec2</field>
        <field name="request_path">/v3/credentials</field>
        <regex>project_id</regex>
        <description>OpenStack Keystone: Potential CVE-2026-43001 exploit - EC2 credential creation with caller-supplied project_id.</description>
        <group>cve_2026_43001,</group>
        <mitre>
            <id>T1190</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 3/4 (LIKELY) — Two independent sources (OSV and Debian) confirm a fix has been released. The upstream OpenStack project has integrated the validation logic in Keystone version 30 and backported security patches to stable branches.

1) Immediate Mitigations (before patching):

• Restrict Application Credentials: If feasible, disable unrestricted application credentials ("unrestricted": false) across all projects. This reduces the role footprint an attacker can inherit, limiting blast radius.
• Network Segmentation: Use Keystone API endpoint rules or a WAF to restrict POST /v3/credentials to trusted IP ranges only. This slows down remote attackers.
• Audit Existing Credentials: Run a script to list all EC2-type credentials and cross-reference their project_id against the authenticated user's projects. Identify anomalies (credentials referencing projects the user has no legitimate authorization to).
• Enable Detailed Audit Logging: Ensure Keystone audit middleware is enabled and shipping logs to a SIEM for real-time monitoring of credential.create and ec2tokens events.

2) Patch/Upgrade Steps:

• Upgrade to OpenStack Keystone version 30 or later if you are on a current release cycle.
• Debian-specific: Run apt-get update && apt-get install python3-keystone after adding the security repository, or use the distro's security advisory channel. The patched versions in Debian are tagged; ensure your package version matches the fixed release.
• After upgrading, validate the fix by attempting to reproduce the payload above — it should now return a 400 Bad Request or 403 Forbidden.

3) Long-Term Hardening:

• Enforce Principle of Least Privilege: Regularly review role assignments for users who hold application credentials. JIT (Just-In-Time) access should be implemented for any app credential creation.
• Harden Keystone Configuration: Use Keystone's option to restrict credential types if EC2 credentials are not strictly needed. In keystone.conf, set [credential] provider = fernet and ensure [credential] key_repository is properly secured; also consider disabling EC2 credential creation entirely if not required.
• Pervasive Monitoring: Deploy audit rules like those in the Detection Guidance section across all Keystone endpoints. Integrate logs into a UEBA or anomaly detection system to catch token scope mismatches (e.g., an app_cred_id whose project differs from the token's project scope).
• Incident Response Preparedness: Update runbooks to include a check for this IOC pattern. Practice the response to a cross-project credential leak.

References

1. NVD Entry — NVD - CVE-2026-43001
2. OpenStack Security Advisory (Upstream Mailing List) — OpenStack Security Notes — official OSSA bulletin for CVE-2026-43001 (expected release cycle).
3. Debian Security Tracker — Debian DSA for CVE-2026-43001

Threat Actor Campaigns / In-the-Wild Evidence: As of the report date, there is no confirmed exploitation in the wild. The EPSS score of 0.00456 (37.3rd percentile) indicates a low estimated probability of exploitation at this time. This is typical for a newly disclosed vulnerability before weaponized exploits become public. However, given the high impact (7.9 CVSS) and the relative simplicity of the attack chain, it is expected that exploit code may surface within 30–60 days. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog. Organizations running Keystone 13–29 should treat this as a priority patch item, especially if they expose the Keystone API externally or have a large user base with application credentials.