CVE-2026-43001
An issue was discovered in OpenStack Keystone before 29.0.2. POST /v3/credentials did not validate that the caller-supplied project_id for an EC2-type credential matched the project of the authenticating application credential. This allowed an attacker holding an unrestricted application credential for project A to create an EC2 credential targeting project B; a subsequent /v3/ec2tokens exchange would then issue a Keystone token scoped to project B while still carrying the original app_cred_id, enabling cross-project lateral movement within the credential owner's role footprint.
- CVSS 3.1
- 8.0
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H - EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 40% of CVEs (scores of 2026-10-26)
- CWEs
- CWE-863, CWE-1288
- Published
- Modified
- Record from
- the NVD, synced
Affected
- openstack:keystone
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-hhq2-3832-xxcv | PyPI | keystone | >=13.0.0 <=29.0.1 | no fix published |
| PYSEC-2026-602 | PyPI | keystone | >=14.0.0 <27.0.2 >=28.0.0 <28.0.2 >=29.0.0 <29.0.2 | 27.0.2, 28.0.2, 29.0.2 |