What is the CVSS score of CVE-2026-43001?

CVE-2026-43001 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Keystone are affected by CVE-2026-43001?

OpenStack Keystone (versions 13-29) contains an authorization bypass flaw allowing application credential holders to mint credentials for unrelated projects and access unauthorized tenant data,…. A patch is available.

How to fix or mitigate CVE-2026-43001?

Within 24 hours: identify all OpenStack Keystone deployments and confirm version (vulnerable if 13-29). Within 7 days: apply the latest security patch available from OpenStack Keystone vendor advisory; validate patch deployment across all instances. Within 30 days: audit all unrestricted application credentials in use; review /v3/credentials and /v3/ec2tokens access logs for unauthorized cross-project activity.

Keystone CVE-2026-43001

EUVD-2026-26488 HIGH

Incorrect Authorization (CWE-863)

2026-05-01 mitre

GHSA-hhq2-3832-xxcv

Authentication Bypass Microsoft Keystone Openstack

8.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.0 HIGH

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Any authenticated user can create an unrestricted app credential (PR:L) and the exploit is a deterministic API sequence (AC:L); authorization crosses to another project (S:C) with high read/write but role-bounded availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N

Red Hat

8.0 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jun 30, 2026 - 04:28 vuln.today

v5 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 04:28 vuln.today

v4 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 04:26 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 04:24 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 30, 2026 - 03:24 vuln.today

cvss_changed

CVSS changed

Jun 30, 2026 - 03:24 NVD

7.9 (HIGH) 8.0 (HIGH)

Analysis Generated

May 01, 2026 - 08:45 vuln.today

EUVD ID Assigned

May 01, 2026 - 08:30 euvd

EUVD-2026-26488

Analysis Generated

May 01, 2026 - 08:30 vuln.today

CVE Published

May 01, 2026 - 00:00 nvd

HIGH 7.9

DescriptionNVD

An issue was discovered in OpenStack Keystone 13 through 29. POST /v3/credentials did not validate that the caller-supplied project_id for an EC2-type credential matched the project of the authenticating application credential. This allowed an attacker holding an unrestricted application credential for project A to create an EC2 credential targeting project B; a subsequent /v3/ec2tokens exchange would then issue a Keystone token scoped to project B while still carrying the original app_cred_id, enabling cross-project lateral movement within the credential owner's role footprint.

AnalysisAI

Cross-project privilege escalation in OpenStack Keystone (releases 13 through 29) lets a holder of an unrestricted application credential for one project mint an EC2-type credential targeting a different project, because POST /v3/credentials never validates that the caller-supplied project_id matches the authenticating app credential's project. Exchanging that EC2 credential at /v3/ec2tokens then yields a Keystone token scoped to the second project while retaining the original app_cred_id, enabling lateral movement across tenants. There is no public exploit identified at time of analysis and EPSS is very low (0.01%), but the authorization flaw (CWE-863) is confirmed and patched by upstream and distributors.