CVE-2026-43001 is an incorrect authorization vulnerability (CWE-863) in OpenStack Keystone prior to 29.0.2. The POST /v3/credentials endpoint did not verify that the caller-supplied project_id for EC2-type credentials matched the project of the authenticating application credential. This flaw allowed an attacker holding an unrestricted application credential for project A to create EC2 credentials targeting project B. Subsequently, exchanging these credentials via /v3/ec2tokens would issue a Keystone token scoped to project B but still associated with the original application credential ID, enabling lateral movement across projects within the credential owner's role permissions. The vulnerability has a CVSS 3.1 base score of 7.9 (high severity) with network attack vector, high complexity, and privileges required. The affected service is cloud-hosted, and the vendor manages remediation.

An attacker with an unrestricted application credential for one project can create EC2 credentials scoped to a different project, allowing them to obtain Keystone tokens scoped to that other project. This enables unauthorized cross-project lateral movement within the attacker's role footprint, potentially exposing or manipulating resources in projects they should not access. The vulnerability impacts confidentiality, integrity, and availability to a high degree within the scope of the credential owner's permissions.

This vulnerability affects OpenStack Keystone cloud services, and the vendor manages remediation for this cloud-hosted service. A fix is available in OpenStack Keystone version 29.0.2 and later. Users of affected versions should upgrade to 29.0.2 or later to resolve this issue. Check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-43001 for the latest remediation guidance and patch availability.