Skip to content
Fencer Intel
high 8.0

CVE-2026-43001 json

OpenStack Keystone has an Incorrect Authorization Issue

published 6mo ago modified 14d ago also GHSA-hhq2-3832-xxcv , PYSEC-2026-602 , EUVD-2026-26488

cvss
8.0
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 40%
public exploits
0
none known

Summary

An issue was discovered in OpenStack Keystone before 29.0.2. POST /v3/credentials did not validate that the caller-supplied project_id for an EC2-type credential matched the project of the authenticating application credential. This allowed an attacker holding an unrestricted application credential for project A to create an EC2 credential targeting project B; a subsequent /v3/ec2tokens exchange would then issue a Keystone token scoped to project B while still carrying the original app_cred_id, enabling cross-project lateral movement within the credential owner's role footprint.

Patch / fix

  • pypi keystone 27.0.2, 28.0.2, 29.0.2
  • OpenStack Keystone 27.0.2, 28.0.2, 29.0.2
  • Red Hat Red Hat OpenStack Services on OpenShift 18.0 1:23.0.3-18.0.20260610133808.9e3dfb4.el9ost
  • keystone Debian 12 2:22.0.2-0+deb12u3
  • keystone Debian 13 2:27.0.0-3+deb13u4
  • keystone Debian 14 2:29.0.1-2

debian advisories DEBIAN-CVE-2026-43001

  • keystone Ubuntu 22.04 LTS 2:21.0.1-0ubuntu2.4
  • keystone Ubuntu 24.04 LTS 2:25.0.0-0ubuntu1.4
  • keystone Ubuntu 25.10 2:28.0.0-0ubuntu1.3
  • keystone Ubuntu 26.04 LTS 2:29.0.0-0ubuntu1.2

ubuntu advisories UBUNTU-CVE-2026-43001

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • etcd openstack 16.2 3.3.23-22.el8ost
  • erlang openstack 16.2 23.3.4.18-2.el8ost
  • erlang-ssl openstack 16.2 23.3.4.18-2.el8ost
  • erlang-asn1 openstack 16.2 23.3.4.18-2.el8ost
  • erlang-erts openstack 16.2 23.3.4.18-2.el8ost
  • erlang-hipe openstack 16.2 23.3.4.18-2.el8ost
  • erlang-sasl openstack 16.2 23.3.4.18-2.el8ost
  • erlang-snmp openstack 16.2 23.3.4.18-2.el8ost

red hat advisories RHSA-2026:54757RHSA-2026:39808RHSA-2026:28044

Is CVE-2026-43001 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-43001 updated cvss 8.0

OpenStack Keystone: OpenStack Keystone: Unauthorized cross-project access due to improper validation in EC2 credential creation

  • Red Hat OpenStack Platform 16.2 python3-keystone 16.0.3-2.20260616134936.9d699a7.el8ost, openstack-keystone 16.0.3-2.20260616134936.9d699a7.el8ost
    fixed: vendor fix RHSA-2026:54757
  • Red Hat OpenStack Platform 17.1 python3-swift 2.27.1-17.1.20231004180819.el9ost, openstack-swift 2.27.1-17.1.20231004180819.el9ost, openstack-swift-proxy 2.27.1-17.1.20231004180819.el9ost, openstack-swift-object 2.27.1-17.1.20231004180819.el9ost, openstack-swift-account 2.27.1-17.1.20231004180819.el9ost, python3-tempest 33.0.0-17.1.20260406141650.1580f6f.el9ost, +6 more
    fixed: vendor fix RHSA-2026:28044
  • Red Hat OpenStack Services on OpenShift 18.0 python3-keystone 23.0.3-18.0.20260610133808.9e3dfb4.el9ost, openstack-keystone 23.0.3-18.0.20260610133808.9e3dfb4.el9ost
    fixed: vendor fix RHSA-2026:39808
  • Red Hat OpenStack Platform 13 (Queens) rhosp13/openstack-keystone
    not affected: component not present
  • Red Hat OpenStack Platform 16.2 etcd 3.3.23-22.el8ost, erlang 23.3.4.18-2.el8ost, python-pyasn1 0.4.6-4.el8ost, erlang-ssl 23.3.4.18-2.el8ost, python3-pyasn1 0.4.6-4.el8ost, erlang-asn1 23.3.4.18-2.el8ost, +79 more
    not affected: vulnerable code not present
  • Red Hat OpenStack Platform 18.0 rhoso/openstack-keystone-rhel9
    not affected: component not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
6mo ago

Exploit prediction

0.47% chance of exploitation in the next 30 days, higher than 40% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • bugs.launchpad.net https://bugs.launchpad.net/keystone/+bug/2149775 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.9 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L
CISA ADP 3.1 8.0 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
NVD 3.1 8.0 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
CNA 3.1 8.0 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
OSV 3.1 8.0 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
GitHub 3.1 7.9 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L

Affected packages

ecosystem package affected fixed in
pypi keystone
>=13.0.0, <=29.0.1
>=14.0.0, <27.0.2
>=28.0.0, <28.0.2
>=29.0.0, <29.0.2
27.0.2
28.0.2
29.0.2

Affected products

  • OpenStack Keystone
  • Red Hat Red Hat OpenStack Services on OpenShift 18.0
  • Red Hat Red Hat OpenStack Platform 13 (Queens)
  • Red Hat Red Hat OpenStack Platform 16.2
  • Red Hat Red Hat OpenStack Platform 17.1
  • Red Hat Red Hat OpenStack Platform 18.0

Classification

Weakness
  • CWE-863 Incorrect Authorization
  • CWE-1288 Improper Validation of Consistency within Input

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.