CVE-2026-43001 — Security Box Score

CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-43001HIGH

OpenStack Keystone — An issue was discovered in OpenStack Keystone before 29.0.2.

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   H   N  C  H  H  H    8.0   .0047   38.7     —

AFFECTED
  Product   Versions  Fixed
  Keystone  14.0.0 –  —

TIMELINE
  May 1   Reserved by mitre
  May 1   Published (CNA: mitre)
  Aug 14  EXPLOIT PUBLISHED — CVE-2026-43001 (OpenStack Keystone). Public exploit reference added.
  Aug 14  RESCORED — CVE-2026-43001 (OpenStack Keystone). CVSS 7.9 → 8 (NVD).

CWE-863, CWE-1288 · CNA: mitre · CVSS v3.1 · 8 references · NVD status: Modified

Description

An issue was discovered in OpenStack Keystone before 29.0.2. POST /v3/credentials did not validate that the caller-supplied project_id for an EC2-type credential matched the project of the authenticating application credential. This allowed an attacker holding an unrestricted application credential for project A to create an EC2 credential targeting project B; a subsequent /v3/ec2tokens exchange would then issue a Keystone token scoped to project B while still carrying the original app_cred_id, enabling cross-project lateral movement within the credential owner's role footprint.

Lifecycle

Complete event history — 4 events, chronological
Date	Event	Detail
May 1, 2026	Reserved	Reserved by mitre
May 1, 2026	Published	Published (CNA: mitre)
August 14, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-43001 (OpenStack Keystone). Public exploit reference added.
August 14, 2026	RESCORED	RESCORED — CVE-2026-43001 (OpenStack Keystone). CVSS 7.9 → 8 (NVD).

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
OpenStack	Keystone	—	14.0.0	—

Weaknesses

CWE-863 · CWE-1288

References (8)

https://access.redhat.com/errata/RHSA-2026:39808
https://access.redhat.com/errata/RHSA-2026:54757
https://access.redhat.com/security/cve/CVE-2026-43001
https://bugs.launchpad.net/keystone/+bug/2149775 [Exploit, Issue Tracking, Patch, Third Party Advisory]
https://bugzilla.redhat.com/show_bug.cgi?id=2464305
https://review.opendev.org/c/openstack/keystone/+/985804 [Patch]
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43001.json
https://security.openstack.org/ossa/OSSA-2026-015.html [Patch, Vendor Advisory]

Authoritative record: CVE-2026-43001 at cve.org

Vendors: openstack

Weaknesses: CWE-863 · CWE-1288

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-43001 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.