SECUFOCUSNOW
Home›CVE index›CVE-2026-43000
Review reviewHigh

CVE-2026-43000

OpenStack Keystone, Red Hat OpenStack Platform 13 (Queens), Red Hat OpenStack Platform 16.2

An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation vulnerability, an attacker with the member role on a project can escalate to admin by chaining unrestricted application credentials with Keystone trusts. The impersonated token carries the victim's identity, which passes the trustor validation check. Keystone then validates the delegated roles against the victim's actual role assignments in the database, not the roles on the requesting token. This allows the attacker to create a trust delegating the victim's admin role to...

CVSS
8.8
EPSS
0.33%
25.3% percentile
CISA KEV
Not listed
Published
2026.05.29
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.33%
Technical severityCVSS 8.8

Vulnerability overview

An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation vulnerability, an attacker with the member role on a project can escalate to admin by chaining unrestricted application credentials with Keystone trusts. The impersonated token carries the victim's identity, which passes the trustor validation check. Keystone then validates the delegated roles against the victim's actual role assignments in the database, not the roles on the requesting token. This allows the attacker to create a trust delegating the victim's admin role to...

Affected product and versions

Product
OpenStack Keystone, Red Hat OpenStack Platform 13 (Queens), Red Hat OpenStack Platform 16.2
Affected versions
>= 14.0.0 < 27.0.2, >= 28.0.0 < 28.0.2, >= 29.0.0 < 29.0.2
Fixed versions
27.0.2, 28.0.2, 29.0.2

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that OpenStack Keystone, Red Hat OpenStack Platform 13 (Queens), Red Hat OpenStack Platform 16.2 and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-266, CWE-863