VDB
CVE-2026-43001
CVE-2026-43001
PUBLISHED
CVSS 7.9 HIGH
Reported by mitre · Published May 1, 2026
An issue was discovered in OpenStack Keystone 13 through 29. POST /v3/credentials did not validate that the caller-supplied project_id for an EC2-type credential matched the project of the authenticating application credential. This allowed an attacker holding an unrestricted application credential for project A to create an EC2 credential targeting project B; a subsequent /v3/ec2tokens exchange would then issue a Keystone token scoped to project B while still carrying the original app_cred_id, enabling cross-project lateral movement within the credential owner's role footprint.
EPSS 0.46% · 37.4th percentile
Risk Scores
CVSS 3.1
7.9
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L
EPSS Score
0.46%
37.4th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| OpenStack | Keystone | 13 |
| openstack | keystone | 13 |
| OpenStack | Keystone | 13 |
Timeline
- May 1, 2026 CVE Published
- May 1, 2026 PoC Published
- May 18, 2026 EPSS Score
- May 19, 2026 EPSS Score
- May 20, 2026 EPSS Score
- May 21, 2026 EPSS Score
- May 22, 2026 EPSS Score
- May 23, 2026 EPSS Score
- May 24, 2026 EPSS Score
- May 25, 2026 EPSS Score
- May 26, 2026 EPSS Score
- May 27, 2026 EPSS Score