What is the CVSS score of CVE-2026-43000?

CVE-2026-43000 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of OpenStack Keystone are affected by CVE-2026-43000?

OpenStack Keystone versions prior to 29.0.2 contain a privilege escalation flaw allowing member-role users to obtain administrative access through malicious credential delegation.. A patch is available.

How to fix or mitigate CVE-2026-43000?

Within 24 hours: Identify all OpenStack Keystone deployments and confirm versions below 29.0.2; assess exposure of credential and trust systems. Within 7 days: Deploy Keystone 29.0.2 or later to staging environments and validate role delegation controls function correctly. Within 30 days: Complete production deployment and forensically review credential/trust activity logs back to initial deployment for indicators of exploitation.

OpenStack Keystone CVE-2026-43000

HIGH

Incorrect Authorization (CWE-863)

2026-05-28 mitre

Authentication Bypass Keystone

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.5 HIGH

AV:N to the Keystone API and PR:L for a member-role account, but AC:H because success requires chaining a separate application-credential impersonation flaw and a victim holding admin; full C/I/A:H on admin takeover.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

8.4 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jun 30, 2026 - 04:19 vuln.today

v5 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 04:18 vuln.today

v4 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 04:18 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 04:14 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 30, 2026 - 03:24 vuln.today

cvss_changed

Severity Changed

Jun 30, 2026 - 03:24 NVD

MEDIUM HIGH

CVSS changed

Jun 30, 2026 - 03:24 NVD

6.0 (MEDIUM) 8.8 (HIGH)

Analysis Generated

May 28, 2026 - 19:30 vuln.today

DescriptionNVD

An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation vulnerability, an attacker with the member role on a project can escalate to admin by chaining unrestricted application credentials with Keystone trusts. The impersonated token carries the victim's identity, which passes the trustor validation check. Keystone then validates the delegated roles against the victim's actual role assignments in the database, not the roles on the requesting token. This allows the attacker to create a trust delegating the victim's admin role to themselves. The trust persists independently, and additional trusts and application credentials can be created to maintain access. All actions are logged under the victim's identity.

AnalysisAI

Privilege escalation in OpenStack Keystone before 29.0.2 lets a user holding only the member role on a project chain unrestricted application credentials with Keystone trusts to obtain admin. Because Keystone validates delegated roles against the victim's actual database role assignments rather than the roles on the requesting token, an attacker who can impersonate a victim's token can mint a trust delegating the victim's admin role to themselves, with all activity logged under the victim's identity. Exploitation is only practical when paired with a separate application-credential impersonation flaw; EPSS is very low (0.03%) and there is no public exploit identified at time of analysis.

Technical ContextAI

Keystone is the centralized identity, authentication, and authorization service for OpenStack, issuing the tokens that govern access to every other OpenStack service (Nova, Neutron, Cinder, etc.). The flaw is a CWE-863 Incorrect Authorization issue in Keystone's trust and application-credential delegation logic: trusts let a trustor delegate a subset of roles to a trustee, and the trustor-validation step confirms the requesting token carries the trustor's identity. The defect is that role validation for the trust is performed against the trustor/victim's persisted role assignments in the database instead of against the (potentially constrained) roles actually present on the requesting token, so an impersonated token that carries the victim's identity passes validation and can delegate the victim's full privilege set, including admin. The single affected CPE is cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:*.

RemediationAI

Vendor-released patch: upgrade Keystone to 29.0.2 or later (the first fixed release), following OSSA-2026-015 (https://security.openstack.org/ossa/OSSA-2026-015.html); operators running distro packages should apply the corresponding Ubuntu update from USN-8433-1 or the Red Hat errata referenced in their VEX (https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43000.json). Because exploitation depends on chaining with an application-credential impersonation flaw, patch any related application-credential vulnerabilities concurrently. Until patched, reduce exposure by restricting who can create application credentials and trusts - for example tighten the relevant Keystone policy rules (identity:create_application_credential, identity:create_trust) so untrusted member-role users cannot mint unrestricted application credentials, accepting the trade-off that legitimate automation relying on self-service credentials/trusts will break. Audit existing trusts and application credentials for unexpected admin-role delegations and revoke suspicious ones; note that because malicious actions are logged under the victim's identity, log review alone is unreliable for detection.