CVE-2026-43001

highPriorität · verfolgen · 32OT-Risiko · erhöhtEPSS 0.005 · 40. PerzentilEUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
0.47% (40th) EPSS
CVSS 8 · high
Is it mine?
10 products
Prüfe deine Angriffsfläche
Who says so?
4 sources
cnnvd · enisa_euvd · osv · nvd

EPSS · bewertet 2026-10-27

An issue was discovered in OpenStack Keystone before 29.0.2. POST /v3/credentials did not validate that the caller-supplied project_id for an EC2-type credential matched the project of the authenticating application credential. This allowed an attacker holding an unrestricted application credential for project A to create an EC2 credential targeting project B; a subsequent /v3/ec2tokens exchange would then issue a Keystone token scoped to project B while still carrying the original app_cred_id, enabling cross-project lateral movement within the credential owner's role footprint.

01

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

8.0
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.18highCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 1.3 · Auswirkung 6
v3.17.9highCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:Lsecondary · ENISA EU
v3.17.9highCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:Lsecondary · cve@mitre.org USAusnutzbarkeit 1.3 · Auswirkung 6
v3.18highCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:HsecondaryAusnutzbarkeit 1.3 · Auswirkung 6
v3.17.9highCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:Lsecondary · OSV
v3.17.3highCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)
02

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Trackcoordinatorcisa_ssvcUS
03

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-1288USCWE-863USCWE-863US
04

betroffene Produkte (10)

Betroffene Produkte und Versionsbereiche.

05

Advisories (2)

Hersteller- und Ökosystem-Meldungen dazu.

  • GHSA-hhq2-3832-xxcvOpenStack Keystone has an Incorrect Authorization Issue2026-05-01ghsa · osvUS

    An issue was discovered in OpenStack Keystone 13 through 29. POST /v3/credentials did not validate that the caller-supplied project_id for an EC2-type credential matched the project of the authenticating application credential. This allowed an attacker holding an unrestricted application credential for project A to create an EC2 credential targeting project B; a subsequent /v3/ec2tokens exchange would then issue a Keystone token scoped to project B while still carrying the original app_cred_id, enabling cross-project lateral movement within the credential owner's role footprint.

  • PYSEC-2026-6022026-05-01vendor · osvUS

    An issue was discovered in OpenStack Keystone before 29.0.2. POST /v3/credentials did not validate that the caller-supplied project_id for an EC2-type credential matched the project of the authenticating application credential. This allowed an attacker holding an unrestricted application credential for project A to create an EC2 credential targeting project B; a subsequent /v3/ec2tokens exchange would then issue a Keystone token scoped to project B while still carrying the original app_cred_id, enabling cross-project lateral movement within the credential owner's role footprint.

06

auch bekannt als (6)

Weitere Namen und Kennungen dieser Entität.

07

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvdenisa_euvdosvnvdNVDCVE.orgMITRE
veröffentlicht 2026-05-01geändert 2026-10-26
08

Referenzen (16)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan