CVE-2026-43001
HIGH EPSS 32.3%
Published May 1, 20261mo ago · Modified Jun 17, 20261w ago
8.0 CVSS 3.1
Published May 1, 2026 1mo ago
Last Modified Jun 17, 2026 1w ago
Description
An issue was discovered in OpenStack Keystone before 29.0.2. POST /v3/credentials did not validate that the caller-supplied project_id for an EC2-type credential matched the project of the authenticating application credential. This allowed an attacker holding an unrestricted application credential for project A to create an EC2 credential targeting project B; a subsequent /v3/ec2tokens exchange would then issue a Keystone token scoped to project B while still carrying the original app_cred_id, enabling cross-project lateral movement within the credential owner's role footprint.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H Attack Vector Network
Attack Complexity High
Privileges Required High
User Interaction None
Scope Changed
Confidentiality High
Integrity High
Availability High
Threat Intelligence
EPSS Exploit Probability
32.3% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available
Weaknesses 1
CWE-863 Incorrect Authorization Authorization
Affected Products 3
References 3
- bugs.launchpad.net https://bugs.launchpad.net/keystone/+bug/2149775
- review.opendev.org https://review.opendev.org/c/openstack/keystone/+/985804
- security.openstack.org https://security.openstack.org/ossa/OSSA-2026-015.html
Remediation
- bugs.launchpad.net https://bugs.launchpad.net/keystone/+bug/2149775
- review.opendev.org https://review.opendev.org/c/openstack/keystone/+/985804
- security.openstack.org https://security.openstack.org/ossa/OSSA-2026-015.html