Staging Environment: Content and features may be unstable or change without notice.
Advisory details: pypa / keystone/PYSEC-2026-601
Advisory ID pypa/keystone/PYSEC-2026-601
Aliases CVE-2026-43000
GHSA-q623-f4j4-p4xj
PYSEC-2026-601
Summary An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation vulnerability, an attacker with the member role on a project can escalate to admin by chaining unrestricted application credentials with Keystone trusts. The impersonated token carries the victim's identity, which passes the trustor validation check. Keystone then validates the delegated roles against the victim's actual role assignments in the database, not the roles on the requesting token. This allows the attacker to create a trust delegating the victim's admin role to themselves. The trust persists independently, and additional trusts and application credentials can be created to maintain access. All actions are logged under the victim's identity.
Status Published
Exploitability 0.5
Weighted Severity 7.9
Risk 4.0
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (0)
There are no known CWE.
System Score Found at
cvssv3.1 8.8 https://github.com/pypa/advisory-database/blob/main/vulns/keystone/PYSEC-2026-601.yaml
Reference id Reference type URL
https://bugzilla.redhat.com/show_bug.cgi?id=2482826
https://security.openstack.org/ossa/OSSA-2026-015.html
2148477 Other https://bugs.launchpad.net/keystone/+bug/2148477
CVE-2026-43000 https://access.redhat.com/security/cve/CVE-2026-43000
CVE-2026-43000.JSON https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43000.json
GHSA-q623-f4j4-p4xj https://github.com/advisories/GHSA-q623-f4j4-p4xj

No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/pypa/advisory-database/blob/main/vulns/keystone/PYSEC-2026-601.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-28T19:41:32Z/

Decision: Track

Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2026/43xxx/CVE-2026-43000.json

Source Advisory: vulnrichment/CVE-2026-43000

View SSVC decision tree 
[{'Exploitation': 'none'},
 {'Automatable': 'no'},
 {'Technical Impact': 'partial'},
 {'Mission Prevalence': 'minimal'},
 {'Public Well-being Impact': 'material'},
 {'Mission & Well-being': 'medium'}]

Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-28T19:41:32Z/

Decision: Track

Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2026/43xxx/CVE-2026-43000.json

Source Advisory: vulnrichment/CVE-2026-43000

View SSVC decision tree 
[{'Exploitation': 'none'},
 {'Automatable': 'no'},
 {'Technical Impact': 'partial'},
 {'Mission Prevalence': 'minimal'},
 {'Public Well-being Impact': 'material'},
 {'Mission & Well-being': 'medium'}]