CVE-2026-42999: [OSSA-2026-015] OpenStack Keystone: Multiple cdential delegation and authorization bypass vulnerabilities (CVE-2026-42998, CVE-2026-42999, CVE-2026-43000, CVE-2026-43001, CVE-2026-44394)
An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone RBAC policy enforcer in enforcecall unconditionally merges the raw JSON request body into the policy enforcement dictionary via policydict.update(jsoninput.copy()), overwriting trusted target data that was previously set from database lookups. Because flask.request.getjson is called with force=True, this works regardless of Content-Type or HTTP method. Any authenticated user can inject arbitrary policy target attributes (e.g., userid, projectid) into the request body to bypass RBAC checks and perform unauthorized operations on resources belonging to other users or projects. This was introduced in commit 5ea59f52 (Rocky/14.0.0).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/keystoneto a version that resolves this vulnerability.Fixed in 2:18.1.0-1+deb11u3Fixed in 2:22.0.2-0+deb12u3Fixed in 2:27.0.0-3+deb13u4Fixed in 2:29.0.1-2 - Upgrade
Upgrade
OpenStack Keystoneto a version that resolves this vulnerability.Fixed in 29.0.2Patch OSSA-2026-015 - Compensating control
Restrict API access to Keystone RBAC-enforcing endpoints to authenticated, trusted clients/users while the upgrade is pending, to reduce the ability for an attacker to inject arbitrary policy target attributes and bypass RBAC checks.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42999?
CVE-2026-42999 has a medium severity rating of 6.
How do I fix CVE-2026-42999?
To address CVE-2026-42999, it is recommended to update OpenStack Keystone to version 29.0.2 or later.
What vulnerabilities are related to CVE-2026-42999?
CVE-2026-42999 is related to other vulnerabilities including CVE-2026-42998, CVE-2026-43000, CVE-2026-43001, and CVE-2026-44394.
What type of issue is CVE-2026-42999?
CVE-2026-42999 is categorized as a credential delegation and authorization bypass vulnerability.
Which software is affected by CVE-2026-42999?
CVE-2026-42999 affects OpenStack Keystone prior to version 29.0.2.