CVE-2026-43000: CWE-863 Incorrect Authorization in OpenStack Keystone
An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation vulnerability, an attacker with the member role on a project can escalate to admin by chaining unrestricted application credentials with Keystone trusts. The impersonated token carries the victim's identity, which passes the trustor validation check. Keystone then validates the delegated roles against the victim's actual role assignments in the database, not the roles on the requesting token. This allows the attacker to create a trust delegating the victim's admin role to themselves. The trust persists independently, and additional trusts and application credentials can be created to maintain access. All actions are logged under the victim's identity.
AI Analysis
Technical Summary
This vulnerability in OpenStack Keystone involves incorrect authorization (CWE-863) that enables privilege escalation. An attacker with a member role can chain unrestricted application credentials with Keystone trusts to impersonate a victim's identity. Keystone validates delegated roles against the victim's actual role assignments in the database rather than the requesting token's roles, allowing the attacker to create persistent trusts that delegate the victim's admin role. This flaw exists in versions prior to 29.0.2 and can be exploited to maintain unauthorized admin access.
Potential Impact
An attacker with limited privileges (member role) can escalate to admin privileges by exploiting this vulnerability. The attacker can create persistent trusts that delegate admin roles, effectively gaining unauthorized administrative control. All malicious actions appear under the victim's identity, complicating detection and attribution. This can lead to unauthorized access, modification, and disruption of OpenStack services.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability affects OpenStack Keystone versions prior to 29.0.2. Users should monitor the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-43000 for updates on patches or official fixes. Until a fix is available, restrict the use of application credentials and trusts to trusted users only and review role assignments carefully to limit potential abuse.
CVE-2026-43000: CWE-863 Incorrect Authorization in OpenStack Keystone
Description
An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation vulnerability, an attacker with the member role on a project can escalate to admin by chaining unrestricted application credentials with Keystone trusts. The impersonated token carries the victim's identity, which passes the trustor validation check. Keystone then validates the delegated roles against the victim's actual role assignments in the database, not the roles on the requesting token. This allows the attacker to create a trust delegating the victim's admin role to themselves. The trust persists independently, and additional trusts and application credentials can be created to maintain access. All actions are logged under the victim's identity.
CVSS v3.1
Score 6.0medium
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in OpenStack Keystone involves incorrect authorization (CWE-863) that enables privilege escalation. An attacker with a member role can chain unrestricted application credentials with Keystone trusts to impersonate a victim's identity. Keystone validates delegated roles against the victim's actual role assignments in the database rather than the requesting token's roles, allowing the attacker to create persistent trusts that delegate the victim's admin role. This flaw exists in versions prior to 29.0.2 and can be exploited to maintain unauthorized admin access.
Potential Impact
An attacker with limited privileges (member role) can escalate to admin privileges by exploiting this vulnerability. The attacker can create persistent trusts that delegate admin roles, effectively gaining unauthorized administrative control. All malicious actions appear under the victim's identity, complicating detection and attribution. This can lead to unauthorized access, modification, and disruption of OpenStack services.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability affects OpenStack Keystone versions prior to 29.0.2. Users should monitor the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-43000 for updates on patches or official fixes. Until a fix is available, restrict the use of application credentials and trusts to trusted users only and review role assignments carefully to limit potential abuse.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mitre
- Date Reserved
- 2026-05-01T00:00:00.000Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-43000","vendor":"Red Hat"}]
Threat ID: 6a188e05e29bf47b501d67bd
Added to database: 05/28/2026, 18:48:37 UTC
Last enriched: 07/30/2026, 23:07:33 UTC
Last updated: 07/31/2026, 19:22:58 UTC
Views: 48
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.