CVE-2026-43000

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-43000
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-43000.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-43000
Aliases
Downstream
Related
Published
2026-05-28T00:00:00Z
Modified
2026-07-08T08:13:28.767535876Z
Severity
  • 6.0 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L CVSS Calculator
Summary
[none]
Details

An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation vulnerability, an attacker with the member role on a project can escalate to admin by chaining unrestricted application credentials with Keystone trusts. The impersonated token carries the victim's identity, which passes the trustor validation check. Keystone then validates the delegated roles against the victim's actual role assignments in the database, not the roles on the requesting token. This allows the attacker to create a trust delegating the victim's admin role to themselves. The trust persists independently, and additional trusts and application credentials can be created to maintain access. All actions are logged under the victim's identity.

Database specific 
{
    "cwe_ids": [
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43000.json",
    "cna_assigner": "mitre",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "14.0.0"
                },
                {
                    "fixed": "27.0.2"
                },
                {
                    "introduced": "28.0.0"
                },
                {
                    "fixed": "28.0.2"
                },
                {
                    "introduced": "29.0.0"
                },
                {
                    "fixed": "29.0.2"
                }
            ]
        },
        {
            "source": "CPE_FIELD",
            "extracted_events": [
                {
                    "introduced": "14.0.0"
                },
                {
                    "fixed": "27.0.2"
                },
                {
                    "introduced": "28.0.0"
                },
                {
                    "fixed": "28.0.2"
                },
                {
                    "introduced": "29.0.0"
                },
                {
                    "fixed": "29.0.2"
                }
            ]
        },
        {
            "source": "DESCRIPTION",
            "extracted_events": [
                {
                    "fixed": "29.0.2"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/openstack/keystone

Affected ranges

Type
GIT
Repo
https://github.com/openstack/keystone
Events
Introduced
c767e254979c96858a81cc4bbe8d9773d4dd539b
Fixed
b896b71557ce8370c442fe05818a74d7a9a623a8
Introduced
a568938e0c967a56ade269c93f42718008487b14
Fixed
3dfbbe7b9bd11dcd64420da0e4eda48b637f4a70
Introduced
3526925ae34a66e626bec985628a421a7694168e
Fixed
7b9f39226744b8db50a6d702cc5f715fc9c17f37
Database specific 
{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "14.0.0"
        },
        {
            "fixed": "27.0.2"
        },
        {
            "introduced": "28.0.0"
        },
        {
            "fixed": "28.0.2"
        },
        {
            "introduced": "29.0.0"
        },
        {
            "fixed": "29.0.2"
        }
    ]
}

Affected versions

28.*
28.0.0
28.0.0.0rc1
28.0.1
29.*
29.0.0
29.0.0.0rc1
29.0.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-43000.json"