OpenStack Keystone Cross-Project EC2 Credential Escalation

An issue was discovered in OpenStack Keystone 13 through 29. POST /v3/credentials did not validate that the caller-supplied project_id for an EC2-type credential matched the project of the authenticating application credential. This allowed an attacker holding an unrestricted application credential for project A to create an EC2 credential targeting project B; a subsequent /v3/ec2tokens exchange would then issue a Keystone token scoped to project B while still carrying the original app_cred_id, enabling cross-project lateral movement within the credential owner's role footprint.

Casky was already ahead

This CVE exploits attack patterns that Casky's 261matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-43001 is an authorization bypass vulnerability in OpenStack Keystone versions 13-29 affecting the EC2 credential creation endpoint. The flaw allows attackers with an unrestricted application credential for one project to create EC2 credentials targeting a different project, then exchange those credentials for tokens scoped to the victim project. This represents a critical lateral movement and privilege escalation risk in multi-tenant cloud environments, impacting any OpenStack deployment where application credentials are used for automation, CI/CD pipelines, or service-to-service authentication. Organizations relying on Keystone's credential isolation assumptions face potential unauthorized access to cross-project resources and data.

Casky's 261 matched security skills—powered by Claude's extended reasoning capabilities—map directly to the privilege escalation (TA0004) and credential access (TA0006) techniques embedded in this vulnerability. Practitioners would detect attack patterns including: suspicious application credential usage spawning EC2 token exchanges across unexpected project boundaries; anomalous token issuance carrying mismatched application credential and project scope identifiers; and POST requests to /v3/credentials with project_id parameters differing from the authenticating credential's assigned project. Claude's analysis correlates these indicators across Keystone logs, IAM audit trails, and token metadata to surface the authorization logic bypass that enables cross-tenant movement—revealing attacks that traditional signature-based detection would miss.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

261 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-43001.

analyzing-cloud-storage-access-patterns

cloud security · low

Run

analyzing-kubernetes-audit-logs

container security · low

Run

analyzing-malicious-url-with-urlscan

phishing defense · medium

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-43001

Casky has 261 skills that investigate the attack patterns behind CVE-2026-43001. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn