# CVE-2026-43001: OpenStack Keystone authorization bypass in EC2 credential creation

Source: https://junglewise.ai/threats/cve-2026-43001-openstack-keystone-authorization-bypass-in-ec2-credential  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-01. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-43001 · Severity: high · CVSS 7.9 · Published 2026-05-01

OpenStack Keystone, the identity service for OpenStack cloud environments, contains a flaw in how it handles application credentials. An attacker with access to a restricted set of credentials for one project can bypass security boundaries to create credentials for a different project. This allows for lateral movement across the cloud environment, potentially giving the attacker unauthorized access to data or resources in projects they should not be able to reach.

Technologies: [keystone (PyPI)](https://junglewise.ai/threats/technologies/keystone). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-43001 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-43001 being exploited in the wild.

**How severe is CVE-2026-43001?** High severity, with a CVSS score of 7.9, published 1 May 2026.

**Which products and versions are affected?** keystone (PyPI) >= 13.0.0, <= 29.0.1, ECOSYSTEM:introduced=13.0.0,last_affected=29.0.1, ECOSYSTEM:introduced=14.0.0,fixed=27.0.2,introduced=28.0.0,fixed=28.0.2,introduced=29.0.0,fixed=29.0.2.

**Is there a fix for CVE-2026-43001?** Yes. keystone (PyPI): upgrade to 29.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-43001 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-43001?** Check whether you run keystone (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- keystone (PyPI): upgrade to 29.0.2 or later

  ```sh
  pip install "keystone>=29.0.2"
  ```


## Technical details

An incorrect authorization vulnerability exists in OpenStack Keystone's 'POST /v3/credentials' endpoint. The service fails to validate that a user-supplied 'project_id' for an EC2-type credential matches the project scope of the authenticating application credential. An attacker possessing an unrestricted application credential for Project A can create an EC2 credential for Project B. When this EC2 credential is later exchanged via 'POST /v3/ec2tokens', Keystone issues a token scoped to Project B while retaining the original application credential ID, effectively bypassing project isolation. This exploit requires high privileges (an existing application credential) and often relies on a privileged service or gateway to perform the final token exchange. The issue is addressed in Keystone version 29.0.2 and related backports.

## Affected products

- OpenStack Keystone >= 13.0.0, < 29.0.2

## Identifiers

- CVE-2026-43001
- GHSA-hhq2-3832-xxcv
- PYSEC-2026-602

## Timeline

- 2026-04-21: disclosed: Bug reported to Launchpad
- 2026-05-01: advisory: Initial GHSA and NVD publication
- 2026-05-28: patched: OpenStack Security Advisory OSSA-2026-015 released with patch details

## References

- [https://bugs.launchpad.net/keystone/+bug/2149775](https://bugs.launchpad.net/keystone/+bug/2149775)
- [https://review.opendev.org/c/openstack/keystone/+/985804](https://review.opendev.org/c/openstack/keystone/+/985804)
- [https://security.openstack.org/ossa/OSSA-2026-015.html](https://security.openstack.org/ossa/OSSA-2026-015.html)

## Related threats

- [PYSEC-2026-2549 - OpenStack Identity Keystone and keystonemiddleware Insufficiently Protected Credentials](https://junglewise.ai/threats/cve-2015-7546-openstack-identity-keystone-and-keystonemiddleware-insufficiently)
- [PYSEC-2026-830 - OpenStack Keystone allows information disclosure during account locking](https://junglewise.ai/threats/cve-2021-38155-openstack-keystone-allows-information-disclosure-during-account)
- [PYSEC-2026-831 - OpenStack Identity Keystone Privilege Escalation vulnerability](https://junglewise.ai/threats/cve-2013-4477-openstack-identity-keystone-privilege-escalation-vulnerability)
- [PYSEC-2026-833 - OpenStack Keystone does not invalidate existing tokens when granting or revoking roles](https://junglewise.ai/threats/cve-2012-4413-openstack-keystone-does-not-invalidate-existing-tokens-when)
- [PYSEC-2026-832 - OpenStack Keystone Improper Authentication vulnerability](https://junglewise.ai/threats/cve-2012-4456-openstack-keystone-improper-authentication-vulnerability)