OpenStack Keystone CVE-2026-43001 Allows Cross-Project Lateral Movement

The National Vulnerability Database has detailed CVE-2026-43001, a critical flaw in OpenStack Keystone versions 13 through 29. This vulnerability stems from inadequate validation within the POST /v3/credentials endpoint. Specifically, Keystone failed to verify that the project_id supplied by a caller for an EC2-type credential matched the project associated with the authenticating application credential.

This oversight creates a significant bypass. An attacker possessing an unrestricted application credential for Project A could craft an EC2 credential targeting Project B. Subsequently, a /v3/ec2tokens exchange would yield a Keystone token scoped to Project B, all while retaining the original application credential identifier. The National Vulnerability Database indicates this effectively enables cross-project lateral movement, allowing an attacker to operate within the credential owner’s role footprint across different projects. The CVSS score is 7.9 (HIGH).

This isn’t just a misconfiguration; it’s a design flaw in the credential validation logic. For defenders, this means a compromised application credential isn’t just contained to its original project. It becomes a pivot point for broader internal compromise. Organizations running OpenStack must recognize this as a critical path to escalating privileges and expanding breach scope.