A flaw in OpenStack Keystone allows unauthenticated attackers to bypass authorization controls, potentially leading to unauthorized system access.

This is an incorrect authorization vulnerability (CWE-863) where the Keystone service improperly validates AWS signatures. An unauthenticated attacker can exploit this by sending requests to specific token endpoints to gain unauthorized authorization.

The ability to obtain unauthorized authorization tokens represents a significant security risk, as it allows attackers to impersonate valid users or services within the OpenStack environment. Given the CVSS score of 7.5, this high severity vulnerability could result in unauthorized access to sensitive data or cloud resources, leading to potential data exfiltration or administrative control over affected infrastructure.

Immediate Action: Update OpenStack Keystone to versions 26.0.1, 27.0.0, or 28.0.0 or later as specified by the vendor security advisory.

Proactive Monitoring: Monitor authentication logs for unusual activity involving the /v3/ec2tokens or /v3/s3tokens endpoints, especially requests originating from untrusted network segments.

Compensating Controls: Implement strict network access controls or Web Application Firewall rules to restrict access to token validation endpoints to known, authorized service ranges.

Public Exploit Available: Unknown

Organizations utilizing OpenStack Keystone must prioritize patching their environments to the remediated versions provided. Failure to address this vulnerability increases the risk of unauthorized access to critical identity and cloud management services. Apply the security updates immediately to protect the integrity and confidentiality of your OpenStack deployment.