Answer in brief
CVE-2026-43001 records a High severity (CVSS 7.9) vulnerability in CISA ADP Vulnrichment. The current sources do not mark it as known exploited. The current feed maps OpenStack/Keystone (generic), keystone (pip). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.9. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps OpenStack/Keystone (generic), keystone (pip). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| OpenStack/Keystonegeneric | >=14.0.0 <27.0.2 || >=28.0.0 <28.0.2 || >=29.0.0 <29.0.2 | 27.0.2, 28.0.2, 29.0.2 |
| keystonepip | >=13.0.0,<=29.0.1 | Not reported |
Published upstream
May 1, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 14, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 11, 2026
An issue was discovered in OpenStack Keystone before 29.0.2. POST /v3/credentials did not validate that the caller-supplied project_id for an EC2-type credential matched the project of the authenticating application credential. This allowed an attacker holding an unrestricted application credential for project A to create an EC2 credential targeting project B; a subsequent /v3/ec2tokens exchange would then issue a Keystone token scoped to project B while still carrying the original app_cred_id, enabling cross-project lateral movement within the credential owner's role footprint.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-43001 records a High severity (CVSS 7.9) vulnerability in CISA ADP Vulnrichment. The current sources do not mark it as known exploited. The current feed maps OpenStack/Keystone (generic), keystone (pip). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.9. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps OpenStack/Keystone (generic), keystone (pip). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| OpenStack/Keystonegeneric | >=14.0.0 <27.0.2 || >=28.0.0 <28.0.2 || >=29.0.0 <29.0.2 | 27.0.2, 28.0.2, 29.0.2 |
| keystonepip | >=13.0.0,<=29.0.1 | Not reported |
Published upstream
May 1, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 14, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 11, 2026
An issue was discovered in OpenStack Keystone before 29.0.2. POST /v3/credentials did not validate that the caller-supplied project_id for an EC2-type credential matched the project of the authenticating application credential. This allowed an attacker holding an unrestricted application credential for project A to create an EC2 credential targeting project B; a subsequent /v3/ec2tokens exchange would then issue a Keystone token scoped to project B while still carrying the original app_cred_id, enabling cross-project lateral movement within the credential owner's role footprint.
Quoted source text, attributed separately from HOL analysis.