OCI Identity Domains Flaw Let User Managers Create Administrator API Keys
Summary
A researcher found that an OCI User Manager could create an identity domain administrator’s API key, enabling privilege escalation. Oracle deployed a fix, which the researcher validated on June 10, 2026.
Key points
- The flaw let Identity Domain AppRole permissions bypass protections that blocked lower-level administrators from changing an Identity Domain Administrator’s email or resetting their password.
- A User Manager could create an API key for the administrator through the Identity Domains SCIM API, gaining the ability to act with that user’s OCI access.
- Testing indicated the privilege escalation required no traditional OCI IAM policy permissions for the lower-level user.
- The issue involved two distinct authorization models: classic OCI IAM policies and Identity Domain AppRoles.
- Oracle deployed fixes in June 2026; the researcher found the issue still reproducible after the first deployment, then confirmed it was resolved on June 10.
Article Details
- Attack Vectors
- A User Manager in an OCI Identity Domain could create an API key for an Identity Domain Administrator through the SCIM API, bypassing the intended administrator-role boundary and enabling privilege escalation.
- The same lower-level role could create SMTP credentials and auth tokens for the administrator.
- Defensive Notes
- Oracle reported deploying fixes on June 4 and June 8, 2026; the researcher confirmed the issue was resolved in their environment on June 10, 2026.
- The fix addressed the AppRole-based privilege-escalation path. The article says it does not prevent API-key creation when the caller has appropriate OCI IAM policy permissions.
MITRE ATT&CK
Vendors
Products
Identity DomainsWhile investigating the OCI-specific concept of identity domains (via my tool creation), I identified a bug that got my name added to the June 2026 critical security update patch.OCIWhile Oracle Cloud Infrastructure (OCI) has a smaller share of the cloud market (compared to AWS, Azure, or GCP), it still provides many of the same core service categories needed to support modern cloud workloads.OCI IAMThus, OCI has two related but distinct authorization models: the more narrowly scoped OCI-specific Identity Domain Roles and traditional OCI IAM policies more aligned with other traditional cloud IAM models.
Tools
Burp Suitean in-depth analysis although of all tools noted here including a lexical parser for policy statements, Burp Suite plugin, and enumeration / graphing python OCI framework.oci-lexer-parserI built a tool to convert these OCI IAM policy statements into JSON for easier analysis: github.com/netspi/oci-lexer-parser.OCInfernoTools such as OCInferno shown below can also surface this relationship.