Vulnerability · Published May 28, 2026 · Assigned by mitre

CVE-2026-43000

Medium 6.0

In plain English

A medium-severity incorrect authorization in Keystone from OpenStack. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.0Medium

Exploit odds (30 days)0.3%top 74.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation vulnerability, an attacker with the member role on a project can escalate to admin by chaining unrestricted application credentials with Keystone trusts. The impersonated token carries the victim's identity, which passes the trustor validation check. Keystone then validates the delegated roles against the victim's actual role assignments in the database, not the roles on the requesting token. This allows the attacker to create a trust delegating the victim's admin role to themselves. The trust persists independently, and additional trusts and application credentials can be created to maintain access. All actions are logged under the victim's identity.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	keystone	2:22.0.2-0+deb12u3	DEBIAN-CVE-2026-43000
Debian:13	keystone	2:27.0.0-3+deb13u4	DEBIAN-CVE-2026-43000
Debian:14	keystone	2:29.0.1-2	DEBIAN-CVE-2026-43000
PyPI	keystone	27.0.2, 28.0.2, 29.0.2	PYSEC-2026-601
PyPI	keystone	27.0.2	GHSA-q623-f4j4-p4xj
PyPI	keystone	28.0.2	GHSA-q623-f4j4-p4xj
PyPI	keystone	29.0.2	GHSA-q623-f4j4-p4xj
Ubuntu:22.04:LTS	keystone	2:21.0.1-0ubuntu2.4	UBUNTU-CVE-2026-43000
Ubuntu:24.04:LTS	keystone	2:25.0.0-0ubuntu1.4	UBUNTU-CVE-2026-43000
Ubuntu:25.10	keystone	2:28.0.0-0ubuntu1.3	UBUNTU-CVE-2026-43000
Ubuntu:26.04:LTS	keystone	2:29.0.0-0ubuntu1.2	UBUNTU-CVE-2026-43000

Affected products (as reported)

Vendor	Product	Versions
OpenStack	Keystone	14.0.0 – before 27.0.228.0.0 – before 28.0.229.0.0 – before 29.0.2

Weakness: CWE-863, CWE-266 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L

References

https://bugs.launchpad.net/keystone/+bug/2148477
https://security.openstack.org/ossa/OSSA-2026-015.html
https://access.redhat.com/security/cve/CVE-2026-43000 vdb-entry, x_refsource_REDHAT
RHBZ#2482826 issue-tracking, x_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43000.json x_sadp-csaf-vex