What is the CVSS score of EUVD-2026-26488?

EUVD-2026-26488 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Keystone are affected by EUVD-2026-26488?

OpenStack Keystone (versions 13-29) contains an authorization bypass flaw allowing application credential holders to mint credentials for unrelated projects and access unauthorized tenant data,…. A patch is available.

How to fix or mitigate EUVD-2026-26488?

Within 24 hours: identify all OpenStack Keystone deployments and confirm version (vulnerable if 13-29). Within 7 days: apply the latest security patch available from OpenStack Keystone vendor advisory; validate patch deployment across all instances. Within 30 days: audit all unrestricted application credentials in use; review /v3/credentials and /v3/ec2tokens access logs for unauthorized cross-project activity.

Keystone EUVD-2026-26488

| CVE-2026-43001 HIGH

Incorrect Authorization (CWE-863)

2026-05-01 mitre

GHSA-hhq2-3832-xxcv

Authentication Bypass Microsoft Keystone

8.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.0 HIGH

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Any authenticated user can create an unrestricted app credential (PR:L) and the exploit is a deterministic API sequence (AC:L); authorization crosses to another project (S:C) with high read/write but role-bounded availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N

Red Hat

8.0 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jun 30, 2026 - 04:28 vuln.today

v5 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 04:28 vuln.today

v4 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 04:26 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 04:24 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 30, 2026 - 03:24 vuln.today

cvss_changed

CVSS changed

Jun 30, 2026 - 03:24 NVD

7.9 (HIGH) 8.0 (HIGH)

Analysis Generated

May 01, 2026 - 08:45 vuln.today

EUVD ID Assigned

May 01, 2026 - 08:30 euvd

EUVD-2026-26488

Analysis Generated

May 01, 2026 - 08:30 vuln.today

CVE Published

May 01, 2026 - 00:00 nvd

HIGH 7.9

DescriptionNVD

An issue was discovered in OpenStack Keystone 13 through 29. POST /v3/credentials did not validate that the caller-supplied project_id for an EC2-type credential matched the project of the authenticating application credential. This allowed an attacker holding an unrestricted application credential for project A to create an EC2 credential targeting project B; a subsequent /v3/ec2tokens exchange would then issue a Keystone token scoped to project B while still carrying the original app_cred_id, enabling cross-project lateral movement within the credential owner's role footprint.

AnalysisAI

Cross-project privilege escalation in OpenStack Keystone (releases 13 through 29) lets a holder of an unrestricted application credential for one project mint an EC2-type credential targeting a different project, because POST /v3/credentials never validates that the caller-supplied project_id matches the authenticating app credential's project. Exchanging that EC2 credential at /v3/ec2tokens then yields a Keystone token scoped to the second project while retaining the original app_cred_id, enabling lateral movement across tenants. There is no public exploit identified at time of analysis and EPSS is very low (0.01%), but the authorization flaw (CWE-863) is confirmed and patched by upstream and distributors.