CyberRota Analysis
AI-GeneratedOpenStack Keystone versions prior to 29.0.3 are vulnerable due to improper handling of tokens obtained through delegated authentication methods, which can allow unauthorized creation, modification, or deletion of credentials via the /v3/credentials API. This vulnerability also enables attackers to access sensitive information, such as TOTP MFA seeds, and manipulate credentials across projects without proper validation. Organizations utilizing OpenStack Keystone with delegated authentication should prioritize patching to mitigate potential exploitation risks.
Original NVD Description
An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods (EC2 credentials, application credentials, OAuth1 access tokens, and trusts) are not blocked from creating, modifying, or deleting credentials via the /v3/credentials API. EC2-derived tokens can additionally read credential blobs, exposing TOTP MFA seeds and other secrets. Also, PATCH /v3/credentials does not validate the requested post-update project_id, allowing any delegated token to move a credential to an unauthorized project. All Keystone deployments using delegated authentication are affected.