This vulnerability in OpenStack Keystone involves incorrect authorization (CWE-863) that enables privilege escalation. An attacker with a member role can chain unrestricted application credentials with Keystone trusts to impersonate a victim's identity. Keystone validates delegated roles against the victim's actual role assignments in the database rather than the requesting token's roles, allowing the attacker to create persistent trusts that delegate the victim's admin role. This flaw exists in versions prior to 29.0.2 and can be exploited to maintain unauthorized admin access.

An attacker with limited privileges (member role) can escalate to admin privileges by exploiting this vulnerability. The attacker can create persistent trusts that delegate admin roles, effectively gaining unauthorized administrative control. All malicious actions appear under the victim's identity, complicating detection and attribution. This can lead to unauthorized access, modification, and disruption of OpenStack services.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability affects OpenStack Keystone versions prior to 29.0.2. Users should monitor the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-43000 for updates on patches or official fixes. Until a fix is available, restrict the use of application credentials and trusts to trusted users only and review role assignments carefully to limit potential abuse.