An authorization bypass vulnerability in OpenStack Keystone enables cross-project lateral movement, posing significant security risks to multi-tenant cloud environments.

This is an incorrect authorization flaw categorized under CWE-863, affecting the POST /v3/credentials endpoint where caller-supplied project identifiers are insufficiently validated against authenticating application credentials by a high-privileged authenticated attacker.

A successful exploit permits cross-project lateral movement within a role footprint, potentially compromising tenant isolation and exposing sensitive data or resources across unauthorized cloud projects. The CVSS score of 7.9 reflects a high severity risk due to the potential for severe confidentiality and integrity impacts in affected cloud deployments.

Immediate Action: Apply the vendor security updates provided by OpenStack as soon as possible to patch the Keystone authentication and credential validation logic.

Proactive Monitoring: Monitor API request logs for anomalous patterns involving the POST /v3/credentials and subsequent /v3/ec2tokens endpoints across multiple project identifiers.

Compensating Controls: Implement strict API rate limiting and review Identity and Access Management roles to ensure high-privileged credentials follow the principle of least privilege.

Public Exploit Available: No

Security teams must treat this authorization bypass with high urgency, particularly in environments hosting multiple tenants or sensitive workloads. System administrators should apply the appropriate vendor patches immediately to restore proper project isolation and prevent unauthorized cross-project access.