CVE-2026-43001
OpenStack Keystone has an Incorrect Authorization Issue
An issue was discovered in OpenStack Keystone before 29.0.2. POST /v3/credentials did not validate that the caller-supplied project_id for an EC2-type credential matched the project of the authenticating application credential. This allowed an attacker holding an unrestricted application credential for project A to create an EC2 credential targeting project B; a subsequent /v3/ec2tokens exchange would then issue a Keystone token scoped to project B while still carrying the original app_cred_id, enabling cross-project lateral movement within the credential owner's role footprint.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
An issue was discovered in OpenStack Keystone before 29.0.2. POST /v3/credentials did not validate that the caller-supplied project_id for an EC2-type credential matched the project of the authenticating application credential. This allowed an attacker holding an unrestricted application credential for project A to create an EC2 credential targeting project B; a subsequent /v3/ec2tokens exchange would then issue a Keystone token scoped to project B while still carrying the original app_cred_id, enabling cross-project lateral movement within the credential owner's role footprint.
- Record
CVE-2026-43001- CVSS 3.1
- 7.9 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L - CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-863, CWE-1288
- Updated
- 2026-11-02
EUVDEUVD-2026-26488
An issue was discovered in OpenStack Keystone before 29.0.2. POST /v3/credentials did not validate that the caller-supplied project_id for an EC2-type credential matched the project of the authenticating application credential. This allowed an attacker holding an unrestricted application credential for project A to create an EC2 credential targeting project B; a subsequent /v3/ec2tokens exchange would then issue a Keystone token scoped to project B while still carrying the original app_cred_id, enabling cross-project lateral movement within the credential owner's role footprint.
- Record
EUVD-2026-26488- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-hhq2-3832-xxcv
OpenStack Keystone has an Incorrect Authorization Issue
An issue was discovered in OpenStack Keystone 13 through 29. POST /v3/credentials did not validate that the caller-supplied project_id for an EC2-type credential matched the project of the authenticating application credential. This allowed an attacker holding an unrestricted application credential for project A to create an EC2 credential targeting project B; a subsequent /v3/ec2tokens exchange would then issue a Keystone token scoped to project B while still carrying the original app_cred_id, enabling cross-project lateral movement within the credential owner's role footprint.
- Record
GHSA-hhq2-3832-xxcv- CVSS 3.1
- 7.9 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L - Weakness
- CWE-863
- Updated
- 2026-11-02
NVD
An issue was discovered in OpenStack Keystone before 29.0.2. POST /v3/credentials did not validate that the caller-supplied project_id for an EC2-type credential matched the project of the authenticating application credential. This allowed an attacker holding an unrestricted application credential for project A to create an EC2 credential targeting project B; a subsequent /v3/ec2tokens exchange would then issue a Keystone token scoped to project B while still carrying the original app_cred_id, enabling cross-project lateral movement within the credential owner's role footprint.
- Record
CVE-2026-43001- CVSS 3.1
- 7.9 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L - CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H - CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-863, CWE-1288
- Updated
- 2026-11-02
OSV
An issue was discovered in OpenStack Keystone before 29.0.2. POST /v3/credentials did not validate that the caller-supplied project_id for an EC2-type credential matched the project of the authenticating application credential. This allowed an attacker holding an unrestricted application credential for project A to create an EC2 credential targeting project B; a subsequent /v3/ec2tokens exchange would then issue a Keystone token scoped to project B while still carrying the original app_cred_id, enabling cross-project lateral movement within the credential owner's role footprint.
- Record
CVE-2026-43001- CVSS 3.1
- 7.9 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L - Weakness
- CWE-863
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-43001
An issue was discovered in OpenStack Keystone before 29.0.2. POST /v3/credentials did not validate that the caller-supplied project_id for an EC2-type credential matched the project of the authenticating application credential. This allowed an attacker holding an unrestricted application credential for project A to create an EC2 credential targeting project B; a subsequent /v3/ec2tokens exchange would then issue a Keystone token scoped to project B while still carrying the original app_cred_id, enabling cross-project lateral movement within the credential owner's role footprint.
- Record
DEBIAN-CVE-2026-43001- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
Show 6 moreShow less
OSVGHSA-hhq2-3832-xxcv
OpenStack Keystone has an Incorrect Authorization Issue
An issue was discovered in OpenStack Keystone 13 through 29. POST /v3/credentials did not validate that the caller-supplied project_id for an EC2-type credential matched the project of the authenticating application credential. This allowed an attacker holding an unrestricted application credential for project A to create an EC2 credential targeting project B; a subsequent /v3/ec2tokens exchange would then issue a Keystone token scoped to project B while still carrying the original app_cred_id, enabling cross-project lateral movement within the credential owner's role footprint.
- Record
GHSA-hhq2-3832-xxcv- CVSS 3.1
- 7.9 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L - Weakness
- CWE-863
- Updated
- 2026-11-02
OSVPYSEC-2026-602
An issue was discovered in OpenStack Keystone before 29.0.2. POST /v3/credentials did not validate that the caller-supplied project_id for an EC2-type credential matched the project of the authenticating application credential. This allowed an attacker holding an unrestricted application credential for project A to create an EC2 credential targeting project B; a subsequent /v3/ec2tokens exchange would then issue a Keystone token scoped to project B while still carrying the original app_cred_id, enabling cross-project lateral movement within the credential owner's role footprint.
- Record
PYSEC-2026-602- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:28044
Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (openstack-keystone) security update
- Record
RHSA-2026:28044- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:39808
Red Hat Security Advisory: Red Hat OpenStack Services on OpenShift 18.0 (openstack-keystone) security update
- Record
RHSA-2026:39808- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:54757
Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 security advisory
- Record
RHSA-2026:54757- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-43001
An issue was discovered in OpenStack Keystone before 29.0.2. POST /v3/credentials did not validate that the caller-supplied project_id for an EC2-type credential matched the project of the authenticating application credential. This allowed an attacker holding an unrestricted application credential for project A to create an EC2 credential targeting project B; a subsequent /v3/ec2tokens exchange would then issue a Keystone token scoped to project B while still carrying the original app_cred_id, enabling cross-project lateral movement within the credential owner's role footprint.
- Record
UBUNTU-CVE-2026-43001- CVSS 3.1
- 7.9 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L - CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
keystonePyPI |
13.0.0 to 29.0.1 | None known |
keystoneDebian:12 |
before 2:22.0.2-0+deb12u3, plus listed versions 2:22.0.0-22:22.0.2-0+deb12u12:22.0.2-0+deb12u2 |
2:22.0.2-0+deb12u3 |
keystoneDebian:13 |
before 2:27.0.0-3+deb13u4, plus listed versions 2:27.0.0-32:27.0.0-3+deb13u12:27.0.0-3+deb13u3 |
2:27.0.0-3+deb13u4 |
keystoneDebian:14 |
before 2:29.0.1-2, plus listed versions 2:27.0.0-32:28.0.0-12:28.0.0-22:28.0.0-32:28.0.0-4 Show 11 moreShow less2:28.0.0-52:28.0.0-62:28.0.0~rc1-12:28.0.0~rc1-22:28.0.0~rc1-42:29.0.0-12:29.0.0-22:29.0.0-32:29.0.0~rc1-12:29.0.0~rc1-22:29.0.1-1 |
2:29.0.1-2 |
keystonePyPI |
13.0.0 to 29.0.1, plus listed versions 13.0.213.0.313.0.414.0.014.0.1 Show 45 moreShow less14.1.014.2.015.0.015.0.0.0rc115.0.0.0rc215.0.116.0.016.0.0.0rc116.0.0.0rc216.0.116.0.217.0.017.0.0.0rc117.0.0.0rc217.0.118.0.018.0.0.0rc118.1.019.0.019.0.0.0rc119.0.0.0rc219.0.120.0.020.0.0.0rc120.0.121.0.021.0.0.0rc121.0.122.0.022.0.0.0rc122.0.122.0.223.0.023.0.0.0rc123.0.123.0.224.0.024.0.0.0rc124.1.025.0.025.0.0.0rc126.0.026.0.0.0rc126.1.026.1.1 |
None known |
keystonePyPI |
14.0.0 up to 27.0.2, 28.0.0 up to 28.0.2, 29.0.0 up to 29.0.2, plus listed versions 14.0.114.1.014.2.015.0.015.0.0.0rc1 Show 45 moreShow less15.0.0.0rc215.0.116.0.016.0.0.0rc116.0.0.0rc216.0.116.0.217.0.017.0.0.0rc117.0.0.0rc217.0.118.0.018.0.0.0rc118.1.019.0.019.0.0.0rc119.0.0.0rc219.0.120.0.020.0.0.0rc120.0.121.0.021.0.0.0rc121.0.122.0.022.0.0.0rc122.0.122.0.223.0.023.0.0.0rc123.0.123.0.224.0.024.0.0.0rc124.1.025.0.025.0.0.0rc126.0.026.0.0.0rc126.1.026.1.127.0.027.0.0.0rc127.0.128.0.1 |
27.0.228.0.229.0.2 |
openstack-swiftRed Hat:openstack:17.1::el9 From an advisory covering 3 CVEs |
before 0:2.27.1-17.1.20231004180819.el9ost | 0:2.27.1-17.1.20231004180819.el9ost |
openstack-swift-accountRed Hat:openstack:17.1::el9 From an advisory covering 3 CVEs |
before 0:2.27.1-17.1.20231004180819.el9ost | 0:2.27.1-17.1.20231004180819.el9ost |
openstack-swift-containerRed Hat:openstack:17.1::el9 From an advisory covering 3 CVEs |
before 0:2.27.1-17.1.20231004180819.el9ost | 0:2.27.1-17.1.20231004180819.el9ost |
openstack-swift-objectRed Hat:openstack:17.1::el9 From an advisory covering 3 CVEs |
before 0:2.27.1-17.1.20231004180819.el9ost | 0:2.27.1-17.1.20231004180819.el9ost |
Show 74 moreShow less
| Package | Affected | Fixed |
|---|---|---|
openstack-swift-proxyRed Hat:openstack:17.1::el9 From an advisory covering 3 CVEs |
before 0:2.27.1-17.1.20231004180819.el9ost | 0:2.27.1-17.1.20231004180819.el9ost |
python3-swiftRed Hat:openstack:17.1::el9 From an advisory covering 3 CVEs |
before 0:2.27.1-17.1.20231004180819.el9ost | 0:2.27.1-17.1.20231004180819.el9ost |
openstack-keystoneRed Hat:openstack:17.1::el9 From an advisory covering 3 CVEs |
before 1:19.0.2-17.1.20260529190847.54dd95d.el9ost | 1:19.0.2-17.1.20260529190847.54dd95d.el9ost |
python3-keystoneRed Hat:openstack:17.1::el9 From an advisory covering 3 CVEs |
before 1:19.0.2-17.1.20260529190847.54dd95d.el9ost | 1:19.0.2-17.1.20260529190847.54dd95d.el9ost |
openstack-tempestRed Hat:openstack:17.1::el9 From an advisory covering 3 CVEs |
before 1:33.0.0-17.1.20260406141650.1580f6f.el9ost | 1:33.0.0-17.1.20260406141650.1580f6f.el9ost |
openstack-tempest-allRed Hat:openstack:17.1::el9 From an advisory covering 3 CVEs |
before 1:33.0.0-17.1.20260406141650.1580f6f.el9ost | 1:33.0.0-17.1.20260406141650.1580f6f.el9ost |
python3-tempestRed Hat:openstack:17.1::el9 From an advisory covering 3 CVEs |
before 1:33.0.0-17.1.20260406141650.1580f6f.el9ost | 1:33.0.0-17.1.20260406141650.1580f6f.el9ost |
python3-tempest-testsRed Hat:openstack:17.1::el9 From an advisory covering 3 CVEs |
before 1:33.0.0-17.1.20260406141650.1580f6f.el9ost | 1:33.0.0-17.1.20260406141650.1580f6f.el9ost |
openstack-keystoneRed Hat:openstack:18.0::el9 From an advisory covering 3 CVEs |
before 1:23.0.3-18.0.20260610133808.9e3dfb4.el9ost | 1:23.0.3-18.0.20260610133808.9e3dfb4.el9ost |
python3-keystoneRed Hat:openstack:18.0::el9 From an advisory covering 3 CVEs |
before 1:23.0.3-18.0.20260610133808.9e3dfb4.el9ost | 1:23.0.3-18.0.20260610133808.9e3dfb4.el9ost |
collectd-sensubilityRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 0:0.2.1-1.1.el8ost | 0:0.2.1-1.1.el8ost |
collectd-sensubility-debuginfoRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 0:0.2.1-1.1.el8ost | 0:0.2.1-1.1.el8ost |
etcdRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 0:3.3.23-22.el8ost | 0:3.3.23-22.el8ost |
etcd-debuginfoRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 0:3.3.23-22.el8ost | 0:3.3.23-22.el8ost |
etcd-debugsourceRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 0:3.3.23-22.el8ost | 0:3.3.23-22.el8ost |
openstack-keystoneRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 1:16.0.3-2.20260616134936.9d699a7.el8ost | 1:16.0.3-2.20260616134936.9d699a7.el8ost |
python3-keystoneRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 1:16.0.3-2.20260616134936.9d699a7.el8ost | 1:16.0.3-2.20260616134936.9d699a7.el8ost |
python-pyasn1Red Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 0:0.4.6-4.el8ost | 0:0.4.6-4.el8ost |
python3-pyasn1Red Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 0:0.4.6-4.el8ost | 0:0.4.6-4.el8ost |
python3-pyasn1-modulesRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 0:0.4.6-4.el8ost | 0:0.4.6-4.el8ost |
openstack-novaRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 1:20.6.2-2.20260317135026.8a24acd.el8ost | 1:20.6.2-2.20260317135026.8a24acd.el8ost |
openstack-nova-apiRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 1:20.6.2-2.20260317135026.8a24acd.el8ost | 1:20.6.2-2.20260317135026.8a24acd.el8ost |
openstack-nova-commonRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 1:20.6.2-2.20260317135026.8a24acd.el8ost | 1:20.6.2-2.20260317135026.8a24acd.el8ost |
openstack-nova-computeRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 1:20.6.2-2.20260317135026.8a24acd.el8ost | 1:20.6.2-2.20260317135026.8a24acd.el8ost |
openstack-nova-conductorRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 1:20.6.2-2.20260317135026.8a24acd.el8ost | 1:20.6.2-2.20260317135026.8a24acd.el8ost |
openstack-nova-consoleRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 1:20.6.2-2.20260317135026.8a24acd.el8ost | 1:20.6.2-2.20260317135026.8a24acd.el8ost |
openstack-nova-migrationRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 1:20.6.2-2.20260317135026.8a24acd.el8ost | 1:20.6.2-2.20260317135026.8a24acd.el8ost |
openstack-nova-novncproxyRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 1:20.6.2-2.20260317135026.8a24acd.el8ost | 1:20.6.2-2.20260317135026.8a24acd.el8ost |
openstack-nova-schedulerRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 1:20.6.2-2.20260317135026.8a24acd.el8ost | 1:20.6.2-2.20260317135026.8a24acd.el8ost |
openstack-nova-serialproxyRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 1:20.6.2-2.20260317135026.8a24acd.el8ost | 1:20.6.2-2.20260317135026.8a24acd.el8ost |
openstack-nova-spicehtml5proxyRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 1:20.6.2-2.20260317135026.8a24acd.el8ost | 1:20.6.2-2.20260317135026.8a24acd.el8ost |
python3-novaRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 1:20.6.2-2.20260317135026.8a24acd.el8ost | 1:20.6.2-2.20260317135026.8a24acd.el8ost |
openstack-glanceRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 1:19.0.5-2.20260512165254.eb6ad61.el8ost | 1:19.0.5-2.20260512165254.eb6ad61.el8ost |
python3-glanceRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 1:19.0.5-2.20260512165254.eb6ad61.el8ost | 1:19.0.5-2.20260512165254.eb6ad61.el8ost |
erlangRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 0:23.3.4.18-2.el8ost | 0:23.3.4.18-2.el8ost |
erlang-asn1Red Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 0:23.3.4.18-2.el8ost | 0:23.3.4.18-2.el8ost |
erlang-asn1-debuginfoRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 0:23.3.4.18-2.el8ost | 0:23.3.4.18-2.el8ost |
erlang-compilerRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 0:23.3.4.18-2.el8ost | 0:23.3.4.18-2.el8ost |
erlang-cryptoRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 0:23.3.4.18-2.el8ost | 0:23.3.4.18-2.el8ost |
erlang-crypto-debuginfoRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 0:23.3.4.18-2.el8ost | 0:23.3.4.18-2.el8ost |
erlang-debuginfoRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 0:23.3.4.18-2.el8ost | 0:23.3.4.18-2.el8ost |
erlang-debugsourceRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 0:23.3.4.18-2.el8ost | 0:23.3.4.18-2.el8ost |
erlang-eldapRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 0:23.3.4.18-2.el8ost | 0:23.3.4.18-2.el8ost |
erlang-erl_interface-debuginfoRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 0:23.3.4.18-2.el8ost | 0:23.3.4.18-2.el8ost |
erlang-ertsRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 0:23.3.4.18-2.el8ost | 0:23.3.4.18-2.el8ost |
erlang-erts-debuginfoRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 0:23.3.4.18-2.el8ost | 0:23.3.4.18-2.el8ost |
erlang-hipeRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 0:23.3.4.18-2.el8ost | 0:23.3.4.18-2.el8ost |
erlang-inetsRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 0:23.3.4.18-2.el8ost | 0:23.3.4.18-2.el8ost |
erlang-kernelRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 0:23.3.4.18-2.el8ost | 0:23.3.4.18-2.el8ost |
erlang-mnesiaRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 0:23.3.4.18-2.el8ost | 0:23.3.4.18-2.el8ost |
erlang-odbc-debuginfoRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 0:23.3.4.18-2.el8ost | 0:23.3.4.18-2.el8ost |
erlang-os_monRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 0:23.3.4.18-2.el8ost | 0:23.3.4.18-2.el8ost |
erlang-os_mon-debuginfoRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 0:23.3.4.18-2.el8ost | 0:23.3.4.18-2.el8ost |
erlang-parsetoolsRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 0:23.3.4.18-2.el8ost | 0:23.3.4.18-2.el8ost |
erlang-public_keyRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 0:23.3.4.18-2.el8ost | 0:23.3.4.18-2.el8ost |
erlang-runtime_toolsRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 0:23.3.4.18-2.el8ost | 0:23.3.4.18-2.el8ost |
erlang-runtime_tools-debuginfoRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 0:23.3.4.18-2.el8ost | 0:23.3.4.18-2.el8ost |
erlang-saslRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 0:23.3.4.18-2.el8ost | 0:23.3.4.18-2.el8ost |
erlang-snmpRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 0:23.3.4.18-2.el8ost | 0:23.3.4.18-2.el8ost |
erlang-sslRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 0:23.3.4.18-2.el8ost | 0:23.3.4.18-2.el8ost |
erlang-stdlibRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 0:23.3.4.18-2.el8ost | 0:23.3.4.18-2.el8ost |
erlang-syntax_toolsRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 0:23.3.4.18-2.el8ost | 0:23.3.4.18-2.el8ost |
erlang-toolsRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 0:23.3.4.18-2.el8ost | 0:23.3.4.18-2.el8ost |
erlang-tools-debuginfoRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 0:23.3.4.18-2.el8ost | 0:23.3.4.18-2.el8ost |
erlang-xmerlRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 0:23.3.4.18-2.el8ost | 0:23.3.4.18-2.el8ost |
python-oslo-messagingRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 0:10.2.4-2.20260710155333.82281a0.el8ost | 0:10.2.4-2.20260710155333.82281a0.el8ost |
python3-oslo-messagingRed Hat:openstack:16.2::el8 From an advisory covering 24 CVEs |
before 0:10.2.4-2.20260710155333.82281a0.el8ost | 0:10.2.4-2.20260710155333.82281a0.el8ost |
keystoneUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2:8.0.0-0ubuntu12:9.0.0~b1-0ubuntu12:9.0.0~b2-0ubuntu12:9.0.0~b3-0ubuntu12:9.0.0~rc1-0ubuntu1 Show 11 moreShow less2:9.0.0-0ubuntu12:9.0.2-0ubuntu12:9.0.2-0ubuntu22:9.1.0-0ubuntu12:9.2.0-0ubuntu12:9.3.0-0ubuntu12:9.3.0-0ubuntu22:9.3.0-0ubuntu32:9.3.0-0ubuntu3.12:9.3.0-0ubuntu3.22:9.3.0-0ubuntu3.2+esm2 |
None known |
keystoneUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2:12.0.0-0ubuntu12:13.0.0~b1-0ubuntu12:13.0.0~b2-0ubuntu12:13.0.0~b3-0ubuntu12:13.0.0~rc1-0ubuntu1 Show 7 moreShow less2:13.0.0~rc2-0ubuntu12:13.0.0-0ubuntu12:13.0.1-0ubuntu12:13.0.2-0ubuntu12:13.0.2-0ubuntu32:13.0.4-0ubuntu12:13.0.4-0ubuntu1+esm1 |
None known |
keystoneUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2:16.0.0-0ubuntu12:17.0.0~b1~git2019121613.db81fee63-0ubuntu12:17.0.0~b2~git2020020513.99733f172-0ubuntu12:17.0.0~b3~git2020032415.9f9040257-0ubuntu12:17.0.0~b3~git2020032415.9f9040257-0ubuntu2 Show 6 moreShow less2:17.0.0~b3~git2020041013.7bb6314e4-0ubuntu12:17.0.0-0ubuntu0.20.04.12:17.0.1-0ubuntu12:17.0.1-0ubuntu22:17.0.1-0ubuntu2+esm12:17.0.1-0ubuntu2+esm2 |
None known |
keystoneUbuntu:22.04:LTS |
before 2:21.0.1-0ubuntu2.4, plus listed versions 2:20.0.0-0ubuntu12:20.0.0+git2021120815.2ddf8f321-0ubuntu12:20.0.0+git2022011217.771c943ad-0ubuntu12:20.0.0+git2022030313.a3fc9e7c3-0ubuntu12:21.0.0-0ubuntu1 Show 4 moreShow less2:21.0.1-0ubuntu12:21.0.1-0ubuntu22:21.0.1-0ubuntu2.12:21.0.1-0ubuntu2.2 |
2:21.0.1-0ubuntu2.4 |
keystoneUbuntu:24.04:LTS |
before 2:25.0.0-0ubuntu1.4, plus listed versions 2:24.0.0-0ubuntu12:24.0.0+git2024011916.adfa92b4-0ubuntu12:25.0.0~rc1-0ubuntu12:25.0.0-0ubuntu12:25.0.0-0ubuntu1.12:25.0.0-0ubuntu1.2 |
2:25.0.0-0ubuntu1.4 |
keystoneUbuntu:25.10 |
before 2:28.0.0-0ubuntu1.3, plus listed versions 2:27.0.0-0ubuntu12:27.0.0+git2025080113.e066e18ab-0ubuntu12:28.0.0~rc1-0ubuntu12:28.0.0-0ubuntu12:28.0.0-0ubuntu1.1 |
2:28.0.0-0ubuntu1.3 |
keystoneUbuntu:26.04:LTS |
before 2:29.0.0-0ubuntu1.2, plus listed versions 2:28.0.0-0ubuntu12:28.0.0-0ubuntu22:28.0.0+git20260119.61.8a42793e7-0ubuntu12:29.0.0~rc1-0ubuntu12:29.0.0-0ubuntu1 |
2:29.0.0-0ubuntu1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-43001 is a high vulnerability (CVSS 7.9) in Openstack Keystone, published May 1, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.47%, the 40th percentile. Fixed in keystone 2:22.0.2-0+deb12u3.
References
bugs.launchpad.net/keystone/+bug/2149775
review.opendev.org/c/openstack/keystone/+/985804
security.openstack.org/ossa/OSSA-2026-015.html
access.redhat.com/security/cve/CVE-2026-43001
bugzilla.redhat.com/show_bug.cgi?id=2464305
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43001.json
Show 188 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-43001
github.com/advisories/GHSA-hhq2-3832-xxcv
security-tracker.debian.org/tracker/CVE-2026-43001
cve.org/CVERecord?id=CVE-2025-65073
openwall.com/lists/oss-security/2025/11/04/2
issues.redhat.com/browse/OSPRH-20808
go.dev/cl/736712
groups.google.com/g/golang-announce/c/Vd2tYVM8eUc
pkg.go.dev/vuln/GO-2026-4341
cna.erlef.org/cves/CVE-2026-42789.html
osv.dev/vulnerability/EEF-CVE-2026-42789
erlang.org/doc/system/versions.html
wiki.openstack.org/wiki/OSSN/OSSN-0096
ubuntu.com/security/CVE-2026-43001
Left out here: 13 versions. The JSON record has them.