https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T14:07:21.840421+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-352410 EUVD-2026-352410 2026-10-04T14:07:21.859018+00:00 EUVD-2026-352410 https://cve.radiocsirt.org/vuln/fkie_cve-2026-43001 fkie_cve-2026-43001 2026-10-04T14:07:21.859078+00:00

An issue was discovered in OpenStack Keystone before 29.0.2. POST /v3/credentials did not validate that the caller-supplied project_id for an EC2-type credential matched the project of the authenticating application credential. This allowed an attacker holding an unrestricted application credential for project A to create an EC2 credential targeting project B; a subsequent /v3/ec2tokens exchange would then issue a Keystone token scoped to project B while still carrying the original app_cred_id, enabling cross-project lateral movement within the credential owner's role footprint.

 https://cve.radiocsirt.org/vuln/ghsa-hhq2-3832-xxcv GHSA-hhq2-3832-xxcv — OpenStack Keystone has an Incorrect Authorization Issue 2026-10-04T14:07:21.859135+00:00

Affected: PyPI: keystone

An issue was discovered in OpenStack Keystone 13 through 29. POST /v3/credentials did not validate that the caller-supplied project_id for an EC2-type credential matched the project of the authenticating application credential. This allowed an attacker holding an unrestricted application credential for project A to create an EC2 credential targeting project B; a subsequent /v3/ec2tokens exchange would then issue a Keystone token scoped to project B while still carrying the original app_cred_id, enabling cross-project lateral movement within the credential owner's role footprint.

 https://cve.radiocsirt.org/vuln/pysec-2026-602 PYSEC-2026-602 2026-10-04T14:07:21.859181+00:00

Affected: PyPI: keystone

An issue was discovered in OpenStack Keystone before 29.0.2. POST /v3/credentials did not validate that the caller-supplied project_id for an EC2-type credential matched the project of the authenticating application credential. This allowed an attacker holding an unrestricted application credential for project A to create an EC2 credential targeting project B; a subsequent /v3/ec2tokens exchange would then issue a Keystone token scoped to project B while still carrying the original app_cred_id, enabling cross-project lateral movement within the credential owner's role footprint.

 https://cve.radiocsirt.org/vuln/rhsa-2026:28044 RHSA-2026:28044 — Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (openstack-keystone) security update 2026-10-04T14:07:21.859235+00:00

openstack-keystone: OpenStack Keystone: Unauthorized access and privilege escalation via AWS signature validation flaw openstack-keystone: OpenStack Keystone: Privilege escalation through EC2 credential creation OpenStack Keystone: OpenStack Keystone: Unauthorized cross-project access due to improper validation in EC2 credential creation

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-43001 UBUNTU-CVE-2026-43001 2026-10-04T14:07:21.859277+00:00

Affected: Ubuntu:Pro:16.04:LTS: keystone, Ubuntu:Pro:18.04:LTS: keystone, Ubuntu:Pro:20.04:LTS: keystone, Ubuntu:22.04:LTS: keystone, Ubuntu:24.04:LTS: keystone, Ubuntu:25.10: keystone, Ubuntu:26.04:LTS: keystone

An issue was discovered in OpenStack Keystone before 29.0.2. POST /v3/credentials did not validate that the caller-supplied project_id for an EC2-type credential matched the project of the authenticating application credential. This allowed an attacker holding an unrestricted application credential for project A to create an EC2 credential targeting project B; a subsequent /v3/ec2tokens exchange would then issue a Keystone token scoped to project B while still carrying the original app_cred_id, enabling cross-project lateral movement within the credential owner's role footprint.