https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 12:36:33 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-340501 EUVD-2026-340501 https://cve.radiocsirt.org/vuln/euvd-2026-340501 https://cve.radiocsirt.org/vuln/fkie_cve-2026-43000 <p>An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation vulnerability, an attacker with the member role on a project can escalate to admin by chaining unrestricted application credentials with Keystone trusts. The impersonated token carries the victim&#39;s identity, which passes the trustor validation check. Keystone then validates the delegated roles against the victim&#39;s actual role assignments in the database, not the roles on the requesting token. This allows the attacker to create a trust delegating the victim&#39;s admin role to themselves. The trust persists independently, and additional trusts and application credentials can be created to maintain access. All actions are logged under the victim&#39;s identity.</p> <p>An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation vulnerability, an attacker with the member role on a project can escalate to admin by chaining unrestricted application credentials with Keystone trusts. The impersonated token carries the victim&#39;s identity, which passes the trustor validation check. Keystone then validates the delegated roles against the victim&#39;s actual role assignments in the database, not the roles on the requesting token. This allows the attacker to create a trust delegating the victim&#39;s admin role to themselves. The trust persists independently, and additional trusts and application credentials can be created to maintain access. All actions are logged under the victim&#39;s identity.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-43000 https://cve.radiocsirt.org/vuln/ghsa-q623-f4j4-p4xj <p><strong>Affected:</strong> PyPI: keystone</p> <p>An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation vulnerability, an attacker with the member role on a project can escalate to admin by chaining unrestricted application credentials with Keystone trusts. The impersonated token carries the victim&#39;s identity, which passes the trustor validation check. Keystone then validates the delegated roles against the victim&#39;s actual role assignments in the database, not the roles on the requesting token. This allows the attacker to create a trust delegating the victim&#39;s admin role to themselves. The trust persists independently, and additional trusts and application credentials can be created to maintain access. All actions are logged under the victim&#39;s identity.</p> <p><strong>Affected:</strong> PyPI: keystone</p> <p>An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation vulnerability, an attacker with the member role on a project can escalate to admin by chaining unrestricted application credentials with Keystone trusts. The impersonated token carries the victim&#39;s identity, which passes the trustor validation check. Keystone then validates the delegated roles against the victim&#39;s actual role assignments in the database, not the roles on the requesting token. This allows the attacker to create a trust delegating the victim&#39;s admin role to themselves. The trust persists independently, and additional trusts and application credentials can be created to maintain access. All actions are logged under the victim&#39;s identity.</p> https://cve.radiocsirt.org/vuln/ghsa-q623-f4j4-p4xj https://cve.radiocsirt.org/vuln/pysec-2026-601 <p><strong>Affected:</strong> PyPI: keystone</p> <p>An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation vulnerability, an attacker with the member role on a project can escalate to admin by chaining unrestricted application credentials with Keystone trusts. The impersonated token carries the victim&#39;s identity, which passes the trustor validation check. Keystone then validates the delegated roles against the victim&#39;s actual role assignments in the database, not the roles on the requesting token. This allows the attacker to create a trust delegating the victim&#39;s admin role to themselves. The trust persists independently, and additional trusts and application credentials can be created to maintain access. All actions are logged under the victim&#39;s identity.</p> <p><strong>Affected:</strong> PyPI: keystone</p> <p>An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation vulnerability, an attacker with the member role on a project can escalate to admin by chaining unrestricted application credentials with Keystone trusts. The impersonated token carries the victim&#39;s identity, which passes the trustor validation check. Keystone then validates the delegated roles against the victim&#39;s actual role assignments in the database, not the roles on the requesting token. This allows the attacker to create a trust delegating the victim&#39;s admin role to themselves. The trust persists independently, and additional trusts and application credentials can be created to maintain access. All actions are logged under the victim&#39;s identity.</p> https://cve.radiocsirt.org/vuln/pysec-2026-601 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-43000 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: keystone, Ubuntu:Pro:18.04:LTS: keystone, Ubuntu:Pro:20.04:LTS: keystone, Ubuntu:22.04:LTS: keystone, Ubuntu:24.04:LTS: keystone, Ubuntu:25.10: keystone, Ubuntu:26.04:LTS: keystone</p> <p>An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation vulnerability, an attacker with the member role on a project can escalate to admin by chaining unrestricted application credentials with Keystone trusts. The impersonated token carries the victim&#39;s identity, which passes the trustor validation check. Keystone then validates the delegated roles against the victim&#39;s actual role assignments in the database, not the roles on the requesting token. This allows the attacker to create a trust delegating the victim&#39;s admin role to themselves. The trust persists independently, and additional trusts and application credentials can be created to maintain access. All actions are logged under the victim&#39;s identity.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: keystone, Ubuntu:Pro:18.04:LTS: keystone, Ubuntu:Pro:20.04:LTS: keystone, Ubuntu:22.04:LTS: keystone, Ubuntu:24.04:LTS: keystone, Ubuntu:25.10: keystone, Ubuntu:26.04:LTS: keystone</p> <p>An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation vulnerability, an attacker with the member role on a project can escalate to admin by chaining unrestricted application credentials with Keystone trusts. The impersonated token carries the victim&#39;s identity, which passes the trustor validation check. Keystone then validates the delegated roles against the victim&#39;s actual role assignments in the database, not the roles on the requesting token. This allows the attacker to create a trust delegating the victim&#39;s admin role to themselves. The trust persists independently, and additional trusts and application credentials can be created to maintain access. All actions are logged under the victim&#39;s identity.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-43000