Vulnerability Report

CVE-2026-43001

Title: OpenStack Keystone Cross-Project Lateral Movement

Other

Proof Of Concept

No public PoC currently indexed for CVE-2026-43001.

CWE Category CWE-863

Published Date May 01, 2026

Modified Date Jul 15, 2026

Exploit Status Not Found

Score 7.9 CVSS v3.1

Exploit Probability (EPSS)

0.46%

Vulnerability Summary

CVE-2026-43001: An issue was discovered in OpenStack Keystone before 29.0.2. POST /v3/credentials did not validate that the caller-supplied project_id for an EC2-type credential matched the project of the authenticating application credential. This allowed an attacker holding an unrestricted application credential for project A to create an EC2 credential targeting project B; a subsequent /v3/ec2tokens exchange would then issue a Keystone token scoped to project B while still carrying the original app_cred_id, enabling cross-project lateral movement within the credential owner's role footprint.

Impacted Vendors

openstack 1

keystonejs 1

Reference Links

https://bugs.launchpad.net/keystone/+bug/2149775 https://review.opendev.org/c/openstack/keystone/+/985804

CVSS v3.1

Source Entity [email protected]

Severity HIGH

8.0

Attack Vector

NETWORK

Complexity

HIGH

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

CHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

CVSS v3.1

Source Entity [email protected]

Severity HIGH

7.9

Attack Vector

NETWORK

Complexity

HIGH

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

CHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L

CVSS v3.1

Source Entity 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

Severity HIGH

8.0

Attack Vector

NETWORK

Complexity

HIGH

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

CHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Associated Attack Patterns (CAPEC)

Total: Patterns