https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 12:51:01 +0000 https://cve.radiocsirt.org/vuln/cve-2026-43000 <p><strong>Affected:</strong> OpenStack Keystone, Red Hat OpenStack Platform 13 (Queens), Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1, Red Hat OpenStack Platform 18.0</p> <p>An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation vulnerability, an attacker with the member role on a project can escalate to admin by chaining unrestricted application credentials with Keystone trusts. The impersonated token carries the victim&#39;s identity, which passes the trustor validation check. Keystone then validates the delegated roles against the victim&#39;s actual role assignments in the database, not the roles on the requesting token. This allows the attacker to create a trust delegating the victim&#39;s admin role to themselves. The trust persists independently, and additional trusts and application credentials can be created to maintain access. All actions are logged under the victim&#39;s identity.</p> <p><strong>Affected:</strong> OpenStack Keystone, Red Hat OpenStack Platform 13 (Queens), Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1, Red Hat OpenStack Platform 18.0</p> <p>An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation vulnerability, an attacker with the member role on a project can escalate to admin by chaining unrestricted application credentials with Keystone trusts. The impersonated token carries the victim&#39;s identity, which passes the trustor validation check. Keystone then validates the delegated roles against the victim&#39;s actual role assignments in the database, not the roles on the requesting token. This allows the attacker to create a trust delegating the victim&#39;s admin role to themselves. The trust persists independently, and additional trusts and application credentials can be created to maintain access. All actions are logged under the victim&#39;s identity.</p> https://cve.radiocsirt.org/vuln/cve-2026-43000 https://cve.radiocsirt.org/vuln/ghsa-q623-f4j4-p4xj <p><strong>Affected:</strong> PyPI: keystone</p> <p>An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation vulnerability, an attacker with the member role on a project can escalate to admin by chaining unrestricted application credentials with Keystone trusts. The impersonated token carries the victim&#39;s identity, which passes the trustor validation check. Keystone then validates the delegated roles against the victim&#39;s actual role assignments in the database, not the roles on the requesting token. This allows the attacker to create a trust delegating the victim&#39;s admin role to themselves. The trust persists independently, and additional trusts and application credentials can be created to maintain access. All actions are logged under the victim&#39;s identity.</p> <p><strong>Affected:</strong> PyPI: keystone</p> <p>An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation vulnerability, an attacker with the member role on a project can escalate to admin by chaining unrestricted application credentials with Keystone trusts. The impersonated token carries the victim&#39;s identity, which passes the trustor validation check. Keystone then validates the delegated roles against the victim&#39;s actual role assignments in the database, not the roles on the requesting token. This allows the attacker to create a trust delegating the victim&#39;s admin role to themselves. The trust persists independently, and additional trusts and application credentials can be created to maintain access. All actions are logged under the victim&#39;s identity.</p> https://cve.radiocsirt.org/vuln/ghsa-q623-f4j4-p4xj