Is CVE-2026-43001 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-43001 being exploited in the wild.

How severe is CVE-2026-43001?

High severity, with a CVSS score of 7.9, published 1 May 2026.

Which products and versions are affected?

keystone (PyPI) >= 13.0.0, <= 29.0.1, ECOSYSTEM:introduced=13.0.0,last_affected=29.0.1, ECOSYSTEM:introduced=14.0.0,fixed=27.0.2,introduced=28.0.0,fixed=28.0.2,introduced=29.0.0,fixed=29.0.2.

Is there a fix for CVE-2026-43001?

Yes. keystone (PyPI): upgrade to 29.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-43001 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-43001?

Check whether you run keystone (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-43001: OpenStack Keystone authorization bypass in EC2 credential creation

Q: Is there a fix for CVE-2026-43001?

Yes. keystone (PyPI): upgrade to 29.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-43001 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-43001?

Check whether you run keystone (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-43001 · Severity: high · CVSS 7.9 · Published 2026-05-01

OpenStack Keystone, the identity service for OpenStack cloud environments, contains a flaw in how it handles application credentials. An attacker with access to a restricted set of credentials for one project can bypass security boundaries to create credentials for a different project. This allows for lateral movement across the cloud environment, potentially giving the attacker unauthorized access to data or resources in projects they should not be able to reach.

Technologies: keystone (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-43001 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-43001 being exploited in the wild.
How severe is CVE-2026-43001?: High severity, with a CVSS score of 7.9, published 1 May 2026.
Which products and versions are affected?: keystone (PyPI) >= 13.0.0, <= 29.0.1, ECOSYSTEM:introduced=13.0.0,last_affected=29.0.1, ECOSYSTEM:introduced=14.0.0,fixed=27.0.2,introduced=28.0.0,fixed=28.0.2,introduced=29.0.0,fixed=29.0.2.
Is there a fix for CVE-2026-43001?: Yes. keystone (PyPI): upgrade to 29.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-43001 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-43001?: Check whether you run keystone (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

keystone (PyPI): upgrade to 29.0.2 or later
```
pip install "keystone>=29.0.2"
```

Technical details

An incorrect authorization vulnerability exists in OpenStack Keystone's 'POST /v3/credentials' endpoint. The service fails to validate that a user-supplied 'project_id' for an EC2-type credential matches the project scope of the authenticating application credential. An attacker possessing an unrestricted application credential for Project A can create an EC2 credential for Project B. When this EC2 credential is later exchanged via 'POST /v3/ec2tokens', Keystone issues a token scoped to Project B while retaining the original application credential ID, effectively bypassing project isolation. This exploit requires high privileges (an existing application credential) and often relies on a privileged service or gateway to perform the final token exchange. The issue is addressed in Keystone version 29.0.2 and related backports.

Affected products

OpenStack Keystone >= 13.0.0, < 29.0.2

Identifiers

CVE-2026-43001
GHSA-hhq2-3832-xxcv
PYSEC-2026-602

Timeline

2026-04-21: disclosed: Bug reported to Launchpad
2026-05-01: advisory: Initial GHSA and NVD publication
2026-05-28: patched: OpenStack Security Advisory OSSA-2026-015 released with patch details

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.