CVE-2026-43001
CVE-2026-43001
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An issue was discovered in OpenStack Keystone before 29.0.2. POST /v3/credentials did not validate that the caller-supplied project_id for an EC2-type credential matched the project of the authenticating application credential. This allowed an attacker holding an unrestricted application credential for project A to create an EC2 credential targeting project B; a subsequent /v3/ec2tokens exchange would then issue a Keystone token scoped to project B while still carrying the original app_cred_id, enabling cross-project lateral movement within the credential owner's role footprint.
CVSS 7.9 · High · EPSS 0.6% · Fix available
- Published
- Updated
Affected products and versions
keystone
- Versions
- ≥ 14.0.0, < 27.0.2: Affected (semver)
- ≥ 28.0.0, < 28.0.2: Affected (semver)
- ≥ 29.0.0, < 29.0.2: Affected (semver)
Update to 27.0.2; Update to 28.0.2; Update to 29.0.2
keystone Debian:12
- Versions
- 2:22.0.0-2
- 2:22.0.2-0+deb12u1
- 2:22.0.2-0+deb12u2
- Affected ranges
- ECOSYSTEM: < 2:22.0.2-0+deb12u3
Update to 2:22.0.2-0+deb12u3
keystone Debian:13
- Versions
- 2:27.0.0-3
- 2:27.0.0-3+deb13u1
- 2:27.0.0-3+deb13u3
- Affected ranges
- ECOSYSTEM: < 2:27.0.0-3+deb13u4
Update to 2:27.0.0-3+deb13u4
keystone Debian:14
- Versions
- 2:27.0.0-3
- 2:28.0.0-1
- 2:28.0.0-2
- 2:28.0.0-3
- 2:28.0.0-4
- 2:28.0.0-5
- 2:28.0.0-6
- 2:28.0.0~rc1-1
- 2:28.0.0~rc1-2
- 2:28.0.0~rc1-4
- 2:29.0.0-1
- 2:29.0.0-2
- 2:29.0.0-3
- 2:29.0.0~rc1-1
- 2:29.0.0~rc1-2
- 2:29.0.1-1
- Affected ranges
- ECOSYSTEM: < 2:29.0.1-2
Update to 2:29.0.1-2
keystone PyPI
- Versions
- 13.0.2
- 13.0.3
- 13.0.4
- 14.0.0
- 14.0.1
- 14.1.0
- 14.2.0
- 15.0.0
- 15.0.0.0rc1
- 15.0.0.0rc2
- 15.0.1
- 16.0.0
- 16.0.0.0rc1
- 16.0.0.0rc2
- 16.0.1
- 16.0.2
- 17.0.0
- 17.0.0.0rc1
- 17.0.0.0rc2
- 17.0.1
- 18.0.0
- 18.0.0.0rc1
- 18.1.0
- 19.0.0
- 19.0.0.0rc1
- 19.0.0.0rc2
- 19.0.1
- 20.0.0
- 20.0.0.0rc1
- 20.0.1
- 21.0.0
- 21.0.0.0rc1
- 21.0.1
- 22.0.0
- 22.0.0.0rc1
- 22.0.1
- 22.0.2
- 23.0.0
- 23.0.0.0rc1
- 23.0.1
- 23.0.2
- 24.0.0
- 24.0.0.0rc1
- 24.1.0
- 25.0.0
- 25.0.0.0rc1
- 26.0.0
- 26.0.0.0rc1
- 26.1.0
- 26.1.1
- 27.0.0
- 27.0.0.0rc1
- 27.0.1
- 27.0.2
- 27.1.0
- 28.0.0
- 28.0.0.0rc1
- 28.0.1
- 28.0.2
- 28.1.0
- 29.0.0
- 29.0.0.0rc1
- 29.0.1
- Affected ranges
- ECOSYSTEM: ≥ 13.0.0, ≤ 29.0.1
No fix published
keystone PyPI
- Versions
- 14.0.0
- 14.0.1
- 14.1.0
- 14.2.0
- 15.0.0
- 15.0.0.0rc1
- 15.0.0.0rc2
- 15.0.1
- 16.0.0
- 16.0.0.0rc1
- 16.0.0.0rc2
- 16.0.1
- 16.0.2
- 17.0.0
- 17.0.0.0rc1
- 17.0.0.0rc2
- 17.0.1
- 18.0.0
- 18.0.0.0rc1
- 18.1.0
- 19.0.0
- 19.0.0.0rc1
- 19.0.0.0rc2
- 19.0.1
- 20.0.0
- 20.0.0.0rc1
- 20.0.1
- 21.0.0
- 21.0.0.0rc1
- 21.0.1
- 22.0.0
- 22.0.0.0rc1
- 22.0.1
- 22.0.2
- 23.0.0
- 23.0.0.0rc1
- 23.0.1
- 23.0.2
- 24.0.0
- 24.0.0.0rc1
- 24.1.0
- 25.0.0
- 25.0.0.0rc1
- 26.0.0
- 26.0.0.0rc1
- 26.1.0
- 26.1.1
- 27.0.0
- 27.0.0.0rc1
- 27.0.1
- 28.0.0
- 28.0.1
- 29.0.0
- 29.0.1
- Affected ranges
- ECOSYSTEM: ≥ 14.0.0, < 27.0.2 ∪ ≥ 28.0.0, < 28.0.2 ∪ ≥ 29.0.0, < 29.0.2
Update to 27.0.2; Update to 28.0.2; Update to 29.0.2
keystone Ubuntu:Pro:16.04:LTS
- Versions
- 2:8.0.0-0ubuntu1
- 2:9.0.0~b1-0ubuntu1
- 2:9.0.0~b2-0ubuntu1
- 2:9.0.0~b3-0ubuntu1
- 2:9.0.0~rc1-0ubuntu1
- 2:9.0.0-0ubuntu1
- 2:9.0.2-0ubuntu1
- 2:9.0.2-0ubuntu2
- 2:9.1.0-0ubuntu1
- 2:9.2.0-0ubuntu1
- 2:9.3.0-0ubuntu1
- 2:9.3.0-0ubuntu2
- 2:9.3.0-0ubuntu3
- 2:9.3.0-0ubuntu3.1
- 2:9.3.0-0ubuntu3.2
- 2:9.3.0-0ubuntu3.2+esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
keystone Ubuntu:Pro:18.04:LTS
- Versions
- 2:12.0.0-0ubuntu1
- 2:13.0.0~b1-0ubuntu1
- 2:13.0.0~b2-0ubuntu1
- 2:13.0.0~b3-0ubuntu1
- 2:13.0.0~rc1-0ubuntu1
- 2:13.0.0~rc2-0ubuntu1
- 2:13.0.0-0ubuntu1
- 2:13.0.1-0ubuntu1
- 2:13.0.2-0ubuntu1
- 2:13.0.2-0ubuntu3
- 2:13.0.4-0ubuntu1
- 2:13.0.4-0ubuntu1+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
keystone Ubuntu:Pro:20.04:LTS
- Versions
- 2:16.0.0-0ubuntu1
- 2:17.0.0~b1~git2019121613.db81fee63-0ubuntu1
- 2:17.0.0~b2~git2020020513.99733f172-0ubuntu1
- 2:17.0.0~b3~git2020032415.9f9040257-0ubuntu1
- 2:17.0.0~b3~git2020032415.9f9040257-0ubuntu2
- 2:17.0.0~b3~git2020041013.7bb6314e4-0ubuntu1
- 2:17.0.0-0ubuntu0.20.04.1
- 2:17.0.1-0ubuntu1
- 2:17.0.1-0ubuntu2
- 2:17.0.1-0ubuntu2+esm1
- 2:17.0.1-0ubuntu2+esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
keystone Ubuntu:22.04:LTS
- Versions
- 2:20.0.0-0ubuntu1
- 2:20.0.0+git2021120815.2ddf8f321-0ubuntu1
- 2:20.0.0+git2022011217.771c943ad-0ubuntu1
- 2:20.0.0+git2022030313.a3fc9e7c3-0ubuntu1
- 2:21.0.0-0ubuntu1
- 2:21.0.1-0ubuntu1
- 2:21.0.1-0ubuntu2
- 2:21.0.1-0ubuntu2.1
- 2:21.0.1-0ubuntu2.2
- Affected ranges
- ECOSYSTEM: < 2:21.0.1-0ubuntu2.4
Update to 2:21.0.1-0ubuntu2.4
keystone Ubuntu:24.04:LTS
- Versions
- 2:24.0.0-0ubuntu1
- 2:24.0.0+git2024011916.adfa92b4-0ubuntu1
- 2:25.0.0~rc1-0ubuntu1
- 2:25.0.0-0ubuntu1
- 2:25.0.0-0ubuntu1.1
- 2:25.0.0-0ubuntu1.2
- Affected ranges
- ECOSYSTEM: < 2:25.0.0-0ubuntu1.4
Update to 2:25.0.0-0ubuntu1.4
keystone Ubuntu:25.10
- Versions
- 2:27.0.0-0ubuntu1
- 2:27.0.0+git2025080113.e066e18ab-0ubuntu1
- 2:28.0.0~rc1-0ubuntu1
- 2:28.0.0-0ubuntu1
- 2:28.0.0-0ubuntu1.1
- Affected ranges
- ECOSYSTEM: < 2:28.0.0-0ubuntu1.3
Update to 2:28.0.0-0ubuntu1.3
keystone Ubuntu:26.04:LTS
- Versions
- 2:28.0.0-0ubuntu1
- 2:28.0.0-0ubuntu2
- 2:28.0.0+git20260119.61.8a42793e7-0ubuntu1
- 2:29.0.0~rc1-0ubuntu1
- 2:29.0.0-0ubuntu1
- Affected ranges
- ECOSYSTEM: < 2:29.0.0-0ubuntu1.2
Update to 2:29.0.0-0ubuntu1.2
Original sources
- https://bugs.launchpad.net/keystone/+bug/2149775
- https://review.opendev.org/c/openstack/keystone/+/985804
- https://security.openstack.org/ossa/OSSA-2026-015.html
- https://access.redhat.com/security/cve/CVE-2026-43001
- https://bugzilla.redhat.com/show_bug.cgi?id=2464305
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43001.json
- https://access.redhat.com/errata/RHSA-2026:54757
- https://access.redhat.com/errata/RHSA-2026:39808
- https://nvd.nist.gov/vuln/detail/CVE-2026-43001