An issue in OpenStack Keystone prior to version 29.0.2 allows an attacker with a member role on a project to elevate privileges to administrator by combining unrestricted application credentials with Keystone trusts. The vulnerability results from Keystone validating delegated roles against the victim's actual role assignments rather than the roles on the requesting token, enabling creation of a trust that grants the victim's admin role to the attacker. All actions are recorded under the victim's identity but the attacker achieves full administrative control.

OpenStack Keystone, versions earlier than 29.0.2. The vulnerability applies to installations where unrestricted application credentials and trust mechanisms are enabled. No specific vendor patches are listed, but any deployment using Keystone before 29.0.2 is affected.

The CVSS score of 6 indicates moderate severity. The EPSS score of 0.00041 (less than 1%) indicates a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack requires an existing member role on a project and the ability to create application credentials; many organizations use trust infrastructure, making the conditions plausible. Because the exploit chain can be repeated and trusts persist, an attacker can maintain elevated access over time.