6

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-43000

CVE-2026-43000: OpenStack Keystone has an Incorrect Authorization issue

An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation vulnerability, an attacker with the member role on a project can escalate to admin by chaining unrestricted application credentials with Keystone trusts. The impersonated token carries the victim's identity, which passes the trustor validation check. Keystone then validates the delegated roles against the victim's actual role assignments in the database, not the roles on the requesting token. This allows the attacker to create a trust delegating the victim's admin role to themselves. The trust persists independently, and additional trusts and application credentials can be created to maintain access. All actions are logged under the victim's identity.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-43000

CVE-2026-43000:

6

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
keystone	pip	>= 14.0.0, < 27.0.2	27.0.2
keystone	pip	>= 28.0.0, < 28.0.2	28.0.2
keystone	pip	>= 29.0.0, < 29.0.2	29.0.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2026-43000, is a privilege escalation in OpenStack Keystone that results from an incorrect authorization check when managing trusts. The exploit requires chaining two vulnerabilities. First, an attacker leverages an impersonation flaw (CVE-2026-42998) to obtain a token for a victim user (e.g., an administrator) by using an application credential they own. The core of CVE-2026-43000 lies in the trust management API, specifically in the keystone.api.trusts.TrustsResource.post method, which is used to create trusts. Before the patch, this endpoint, via the internal _check_unrestricted method, failed to block trust creation requests made with unrestricted application credentials. An attacker could therefore use their impersonated, high-privilege token to create a new trust that delegates the victim's administrative roles to the attacker. Because Keystone validated the roles being delegated against the victim's actual roles in the database, rather than the limited roles of the token making the request, the privilege escalation was successful. The patch addresses this by completely forbidding all trust management operations (create, list, get, delete) when authenticating with any type of application credential, thereby closing the exploit path.

Vulnerable functions

TrustResourceBase._check_unrestricted

keystone/api/trusts.py

This method contained the core logic flaw for CVE-2026-43000. It was supposed to check if an operation was allowed, but it only blocked *restricted* application credentials from managing trusts, incorrectly permitting *unrestricted* ones. An attacker could create an unrestricted application credential and use it (in combination with an impersonation vulnerability) to create a trust and escalate privileges. The method is called by the `post` and `delete` methods of the trust API endpoints.

TrustsResource.post

keystone/api/trusts.py

This function, which handles trust creation (`POST /OS-TRUST/trusts`), is the primary entry point for the privilege escalation exploit. It called the vulnerable `_check_unrestricted` method, which failed to block trust creation when using an unrestricted application credential. This allowed an attacker, using an impersonated token, to create a trust that delegated a victim's higher-level roles to themselves.

TrustsResource.get

keystone/api/trusts.py

This function for listing trusts (`GET /OS-TRUST/trusts`) was vulnerable because it did not prevent the use of application credentials. This could lead to information disclosure, allowing an attacker to enumerate existing trusts, which should not be accessible via a delegated, single-project credential. The patch adds a call to `_check_application_credential` to forbid this action.

TrustResource.get

keystone/api/trusts.py

This function for fetching a specific trust (`GET /OS-TRUST/trusts/{trust_id}`) was vulnerable as it allowed access via application credentials. This could lead to information disclosure about a specific trust's details. The patch adds a call to `_check_application_credential` to forbid this action.

TrustResource.delete

keystone/api/trusts.py

This function for deleting trusts (`DELETE /OS-TRUST/trusts/{trust_id}`) was vulnerable because it called the flawed `_check_unrestricted` method. This allowed an attacker with an unrestricted application credential to delete trusts, which could be used for denial of service or to cover tracks.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.