CVE-2026-43000: OpenStack Keystone privilege escalation via trust delegation

CVE-2026-43000 · Severity: medium · CVSS 6 · Published 2026-05-28

OpenStack Keystone, the identity service for OpenStack cloud environments, contains a vulnerability that allows a standard user to escalate their privileges to an administrator. By exploiting a flaw in how credentials and 'trusts' are handled, an attacker can impersonate another user and grant themselves administrative access to a project. This could lead to unauthorized access to sensitive cloud resources, data theft, or service disruption, while making the malicious actions appear as if they were performed by the victim.

Technologies: keystone (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-43000 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-43000 being exploited in the wild.
How severe is CVE-2026-43000?
Medium severity, with a CVSS score of 6, published 28 May 2026.
Which products and versions are affected?
keystone (PyPI) ECOSYSTEM:introduced=14.0.0,fixed=27.0.2, ECOSYSTEM:introduced=14.0.0,fixed=27.0.2,introduced=28.0.0,fixed=28.0.2,introduced=29.0.0,fixed=29.0.2.
Is there a fix for CVE-2026-43000?
Yes. keystone (PyPI): upgrade to 27.0.2, 29.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-43000 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-43000?
Check whether you run keystone (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • keystone (PyPI): upgrade to 27.0.2, 29.0.2 or later
    pip install "keystone>=29.0.2"

Technical details

An incorrect authorization issue exists in OpenStack Keystone's handling of application credentials and trusts. When an attacker uses an impersonated token (obtained via a separate credential impersonation flaw) to create a Keystone trust, the system correctly identifies the victim as the trustor but fails to validate delegated roles against the requesting token's scope. Instead, Keystone validates the roles against the victim's actual database assignments. This allows an attacker with a 'member' role to create a trust delegating the victim's 'admin' role to themselves. The resulting trust is persistent and allows the attacker to maintain administrative access even if the original credentials are revoked. The attack requires network access and valid low-privileged credentials on a project shared with the victim.

Affected products

  • OpenStack Keystone >= 14.0.0, < 27.0.2; >= 28.0.0, < 28.0.2; >= 29.0.0, < 29.0.2
  • Red Hat Red Hat OpenStack Platform 13 (Queens)
  • Red Hat Red Hat OpenStack Platform 16.2
  • Red Hat Red Hat OpenStack Platform 17.1
  • Red Hat Red Hat OpenStack Platform 18.0

Identifiers

  • CVE-2026-43000
  • GHSA-q623-f4j4-p4xj
  • PYSEC-2026-601

Timeline

  • 2026-04-15: disclosed: Bug reported to OpenStack Launchpad
  • 2026-05-28: advisory: Initial GHSA and NVD publication
  • 2026-07-02: patched: Advisory updated with patched versions 27.0.2, 28.0.2, and 29.0.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.