Read the docs
TI-2026-31180 Aliases CVE-2026-43000GHSA-q623-f4j4-p4xj

Incorrect authorization in OpenStack Keystone

Priority LOW 38CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass, Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 1 fixed, 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-863 and CWE-266.

Summary

An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation vulnerability, an attacker with the member role on a project can escalate to admin by chaining unrestricted application credentials with Keystone trusts. The impersonated token carries the victim's identity, which passes the trustor validation check. Keystone then validates the delegated roles against the victim's actual role assignments in the database, not the roles on the requesting token. This allows the attacker to create a trust delegating the victim's admin role to themselves. The trust persists independently, and additional trusts and application credentials can be created to maintain access. All actions are logged under the victim's identity.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00328 26th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Keystone (OpenStack): 27.0.2, 28.0.2, 29.0.2keystone (PyPI): 27.0.2, 28.0.2, 29.0.2Red Hat: 1 advisoryRed Hat: 1 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenStackKeystone14.0.0 to before 27.0.2; 28.0.0 to before 28.0.2; 29.0.0 to before 29.0.227.0.2, 28.0.2, 29.0.2Patch availableCNA
—keystone (PyPI)14.0.0 to before 27.0.227.0.2Patch availableGHSA-q623-f4j4-p4xj
—keystone (PyPI)28.0.0 to before 28.0.228.0.2Patch availableGHSA-q623-f4j4-p4xj
—keystone (PyPI)29.0.0 to before 29.0.229.0.2Patch availableGHSA-q623-f4j4-p4xj
  • Keystone VendorOpenStack Affected 14.0.0 to before 27.0.2; 28.0.0 to before 28.0.2; 29.0.0 to before 29.0.2 Fixed in 27.0.2, 28.0.2, 29.0.2 Patch available CNA
  • keystone (PyPI) Vendor— Affected 14.0.0 to before 27.0.2 Fixed in 27.0.2 Patch available GHSA-q623-f4j4-p4xj
  • keystone (PyPI) Vendor— Affected 28.0.0 to before 28.0.2 Fixed in 28.0.2 Patch available GHSA-q623-f4j4-p4xj
  • keystone (PyPI) Vendor— Affected 29.0.0 to before 29.0.2 Fixed in 29.0.2 Patch available GHSA-q623-f4j4-p4xj

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:*14.0.0 to before 27.0.2; 28.0.0 to before 28.0.2; 29.0.0 to before 29.0.2VulnerableOpenStack
  • cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:* Versions 14.0.0 to before 27.0.2; 28.0.0 to before 28.0.2; 29.0.0 to before 29.0.2 Vulnerable ·OpenStack

Remediation

  • Fix · CNA Keystone (OpenStack) Fixed in 27.0.2, 28.0.2, 29.0.2
  • Fix · GHSA-q623-f4j4-p4xj keystone (PyPI) Fixed in 27.0.2 Advisory →
  • Fix · GHSA-q623-f4j4-p4xj keystone (PyPI) Fixed in 28.0.2 Advisory →
  • Fix · GHSA-q623-f4j4-p4xj keystone (PyPI) Fixed in 29.0.2 Advisory →

Red Hat 1 advisory

  • RHSA-2026:94039 Released 2026-11-02 · Red Hat rating Important
    Red Hat OpenStack Platform 13.0 security advisory
    • Red Hat OpenStack Platform 13.0 - ELS openstack-keystone-1:13.0.4-10.el7ost, openstack-nova-1:17.0.13-43.el7ost, openstack-nova-api-1:17.0.13-43.el7ost +16

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    OpenStack Keystone 27.0.2, 28.0.2, 29.0.2

    4 records Highest priority Priority LOW 4 LOW

    Other records, highest priority first

    • TI-2026-31179 Incorrect authorization in OpenStack KeystonePriority LOW 38
    • TI-2026-31178 Incorrect authorization in OpenStack KeystonePriority LOW 38
    • TI-2026-32344 Incorrect authorization in OpenStack KeystonePriority LOW 35
    Show all 4 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenStack Platform 16.2AffectedNo fix yet
Red Hat OpenStack Platform 17.1AffectedNo fix yet
Red Hat OpenStack Platform 18.0AffectedNo fix yet
Red Hat OpenStack Platform 13.0 - ELSFixed RHSA-2026:94039
Not affected: 1 product
  • Red Hat OpenStack Platform 13.0 - ELS

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-43000
  2. 2026-10-03 Alias added: GHSA-q623-f4j4-p4xj
  3. 2026-11-03 Fix available: RHSA-2026:94039 · Red Hat
  4. 2026-11-03 Fix available: Red Hat OpenStack Platform 13.0 - ELS · Red Hat

References

Exploit 1

Patch 1

Advisory 1

Other 5

  • TI-2026-25942 Incorrect authorization in OpenStack Keystone CVSS 3.1MEDIUM 5.3
  • TI-2020-10091 An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. CVSS 3.1HIGH 8.8
  • TI-2020-10090 An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. CVSS 3.1HIGH 8.8
  • TI-2019-14184 OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials… CVSS 3.1HIGH 8.8
  • TI-2020-10089 An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. CVSS 3.1HIGH 8.8
  • TI-2014-02273 The V3 API in OpenStack Identity (Keystone) 2013.1 before 2013.2.4 and icehouse before… CVSS 2.0HIGH 7.8
See all 43 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences