CVE-2026-43000

Descrição

An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation vulnerability, an attacker with the member role on a project can escalate to admin by chaining unrestricted application credentials with Keystone trusts. The impersonated token carries the victim-s identity, which passes the trustor validation check. Keystone then validates the delegated roles against the victim-s actual role assignments in the database, not the roles on the requesting token. This allows the attacker to create a trust delegating the victim-s admin role to themselves. The trust persists independently, and additional trusts and application credentials can be created to maintain access. All actions are logged under the victim-s identity.