Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
OpenStack Keystone — An issue was discovered in OpenStack Keystone before 29.0.2.
AV AC PR UI S C I A CVSS EPSS %ile KEV
N L L N U H H H 8.8 .0033 25.7 —
AFFECTED
Product Versions Fixed
Keystone 14.0.0 – —
TIMELINE
May 1 Reserved by mitre
May 28 EXPLOIT PUBLISHED — CVE-2026-43000 (OpenStack Keystone). Public exploit reference added.
May 28 Published (CNA: mitre)
Jul 23 EXPLOIT PUBLISHED — CVE-2026-43000 (OpenStack Keystone). Public exploit reference added.
Jul 23 RESCORED — CVE-2026-43000 (OpenStack Keystone). CVSS 6 → 8.8 (NVD).
Description
An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation vulnerability, an attacker with the member role on a project can escalate to admin by chaining unrestricted application credentials with Keystone trusts. The impersonated token carries the victim's identity, which passes the trustor validation check. Keystone then validates the delegated roles against the victim's actual role assignments in the database, not the roles on the requesting token. This allows the attacker to create a trust delegating the victim's admin role to themselves. The trust persists independently, and additional trusts and application credentials can be created to maintain access. All actions are logged under the victim's identity.
Lifecycle
Complete event history — 5 events, chronological
| Date | Event | Detail |
|---|
| May 1, 2026 | Reserved | Reserved by mitre |
| May 28, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-43000 (OpenStack Keystone). Public exploit reference added. |
| May 28, 2026 | Published | Published (CNA: mitre) |
| July 23, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-43000 (OpenStack Keystone). Public exploit reference added. |
| July 23, 2026 | RESCORED | RESCORED — CVE-2026-43000 (OpenStack Keystone). CVSS 6 → 8.8 (NVD). |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| OpenStack | Keystone | — | 14.0.0 | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-43000 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.