CVE-2026-43000
MediumCVSS 6.0Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
In OpenStack Keystone before version 29.0.2, a vulnerability combined with an application credential impersonation flaw allows an attacker with the member role on a project to escalate to admin. By chaining unrestricted application credentials with Keystone trusts, the attacker can impersonate a victim and create a trust delegating the victim's admin role to themselves.
Risk Assessment
The organization risks unauthorized administrative takeover of a project by a low-privileged user. The attacker's actions are logged under the victim's identity, making detection difficult and potentially enabling persistent unauthorized access.
Recommendation
Immediately upgrade OpenStack Keystone to version 29.0.2 or later. Additionally, restrict the creation of unrestricted application credentials and monitor logs for suspicious trust operations.
Original NVD description (English source)
An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation vulnerability, an attacker with the member role on a project can escalate to admin by chaining unrestricted application credentials with Keystone trusts. The impersonated token carries the victim's identity, which passes the trustor validation check. Keystone then validates the delegated roles against the victim's actual role assignments in the database, not the roles on the requesting token. This allows the attacker to create a trust delegating the victim's admin role to themselves. The trust persists independently, and additional trusts and application credentials can be created to maintain access. All actions are logged under the victim's identity.