CVE-2026-43000: OpenStack Keystone Incorrect Authorization Vulnerability
Summary
CVE-2026-43000: OpenStack Keystone has an Incorrect Authorization issue. Affects keystone across 3 version ranges.
>= 14.0.0, < 27.0.2
>= 28.0.0, < 28.0.2
>= 29.0.0, < 29.0.2
Fixed in 27.0.2, 28.0.2 or 29.0.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenStack Keystone is an identity service used for authentication and authorization in OpenStack cloud environments. It provides a central directory of users and their associated roles, enabling secure access to cloud resources. Keystone supports various authentication methods and integrates with other OpenStack services to manage user identities and permissions effectively. However, it is susceptible to an Incorrect Authorization issue that can lead to privilege escalation.
Vulnerability Detail
An issue was discovered in OpenStack Keystone before version 29.0.2. When combined with an application credential impersonation vulnerability, an attacker with the member role on a project can escalate to admin by chaining unrestricted application credentials with Keystone trusts. The impersonated token carries the victim's identity, which passes the trustor validation check. Keystone validates the delegated roles against the victim's actual role assignments in the database, not the roles on the requesting token. This allows the attacker to create a trust delegating the victim's admin role to themselves. The trust persists independently, and additional trusts and application credentials can be created to maintain access. All actions are logged under the victim's identity.
How To Fix
Latest published version: 30.0.0 as of 22 Oct 2026
pip install --upgrade "keystone==30.0.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 14.0.0, < 27.0.227.0.2pip install --upgrade "keystone==27.0.2" -
>= 28.0.0, < 28.0.228.0.2pip install --upgrade "keystone==28.0.2" -
>= 29.0.0, < 29.0.229.0.2pip install --upgrade "keystone==29.0.2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, restrict the use of application credentials and trusts until the package can be updated. Review role assignments and ensure that only necessary permissions are granted to users within your OpenStack environment.
Conclusion
The OpenStack Keystone Incorrect Authorization vulnerability (CVE-2026-43000) poses a significant risk by allowing privilege escalation through improper trust validation. It is crucial to update the Keystone package to the latest version to mitigate this risk and ensure the security of your OpenStack environment.
See every vulnerability recorded for keystone →
FAQ
CVE-2026-43000 is a vulnerability in OpenStack Keystone that allows an attacker to escalate privileges from a member role to an admin role by exploiting application credential impersonation and trust delegation.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without requiring access to the code.
If exploited, this vulnerability can allow unauthorized users to gain admin access, potentially leading to data breaches, unauthorized changes to configurations, and other malicious activities within the OpenStack environment.
The CVSS score for this vulnerability is 6.0, indicating a moderate severity level.
Mitigation can be achieved by updating the Keystone package to the latest patched version and reviewing role assignments to limit unnecessary permissions.
Related vulnerabilities
Recent vulnerabilities recorded for keystone.
