CVE-2020-12690

Vulnerability

CVE-2020-12690 is a vulnerability in OpenStack Keystone's OAuth1 token API. When an OAuth1 access token is created, the list of roles provided by the user is silently ignored. Instead, when the access token is later used to request a Keystone token, the resulting token includes all role assignments that the creator had for the project, not just the specified subset [1][2].

Exploitation

An attacker who can create an OAuth1 access token for a project can exploit this by obtaining a Keystone token that grants more privileges than intended. The attack does not require special network access beyond being able to interact with the Keystone API, and the attacker must have some role assignment on the project to begin with [3].

Impact

Successful exploitation leads to privilege escalation: the attacker gains a token with every role assignment the creator held for the project, potentially allowing unauthorized access to resources or actions that the creator did not intend to delegate [4].

Mitigation

The vulnerability is fixed in Keystone 15.0.1 and later versions. Users running Keystone 16.0.0 should upgrade to a patched version. No workaround is documented; applying the patch is recommended [2][4].