CVE-2026-43001

An issue was discovered in OpenStack Keystone before 29.0.2. POST /v3/credentials did not validate that the caller-supplied project_id for an EC2-type credential matched the project of the authenticating application credential. This allowed an attacker holding an unrestricted application credential for project A to create an EC2 credential targeting project B; a subsequent /v3/ec2tokens exchange would then issue a Keystone token scoped to project B while still carrying the original app_cred_id, enabling cross-project lateral movement within the credential owner's role footprint.

• CWE-863
• CWE-1288

• https://bugs.launchpad.net/keystone/+bug/2149775Exploit, Issue Tracking, Patch, Third Party Advisory
• https://review.opendev.org/c/openstack/keystone/+/985804Patch
• https://security.openstack.org/ossa/OSSA-2026-015.htmlPatch, Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:39808
• https://access.redhat.com/security/cve/CVE-2026-43001
• https://bugzilla.redhat.com/show_bug.cgi?id=2464305
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43001.json

Published

May 1, 2026

Last Modified

Jul 15, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-42996JS8Call through 2.3.1 and JS8Call-improved before 3.0 have a…10
• CVE-2026-42997An issue was discovered in idrac in OpenStack Ironic before …7.7
• CVE-2026-42998An issue was discovered in OpenStack Keystone before 29.0.2.…8.8
• CVE-2026-42999An issue was discovered in OpenStack Keystone before 29.0.2.…8.8
• CVE-2026-4300The Robo Gallery plugin for WordPress is vulnerable to Store…6.4
• CVE-2026-43000An issue was discovered in OpenStack Keystone before 29.0.2.…8.8
• CVE-2026-43002An issue was discovered in OpenStack Horizon 25.6 and 25.7 b…5.3
• CVE-2026-43003An issue was discovered in OpenStack ironic-python-agent 1.0…7.5
• CVE-2026-43004In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-43005In the Linux kernel, the following vulnerability has been re…7.1
• CVE-2026-43006In the Linux kernel, the following vulnerability has been re…7.1
• CVE-2026-43007In the Linux kernel, the following vulnerability has been re…7.8