CVE-2026-42998

Aliases:GHSA-8f8m-wrvr-wcvfPYSEC-2026-599
Advisory lineage Upstream: 0 Downstream: 3
Analyzed
Published: 28 May 2026, 00:00
Last modified:28 May 2026, 19:38

Vulnerability Summary

Overall Risk (default)
medium
45/100
CVSS Score
8.8 HIGH
v3.1 (nvd)
EPSS Score
0.3% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

28 May 2026, 00:00
Published
Vulnerability first disclosed
28 May 2026, 19:38
Last Modified
Vulnerability information updated

Description

An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone application credential authentication plugin does not verify that the user supplied in the authentication request matches the owner of the application credential. An attacker can authenticate with their own application credential ID and secret while specifying a different user's name and domain in the request body. Keystone issues a token attributed to the victim user. The impersonated token is project-scoped and carries the intersection of the application credential's roles and the victim's actual roles on the project. This enables audit evasion, reading the victim's credentials, and acting as the victim within shared projects.

CVSS Metrics

  • v3.1•MEDIUM•Score: 6CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L
  • v3.1•HIGH•Score: 8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 0.30%• Percentile: 22%

Techniques & Countermeasures

  • CWE-863•Incorrect Authorization

    The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Affected Systems

  • openstack•keystone

    ≥ 14.0.0, < 27.0.2 | ≥ 28.0.0, < 28.0.2 | ≥ 29.0.0, < 29.0.2

  • PyPI•keystone

    ≥ 14.0.0, < 27.0.2 | ≥ 28.0.0, < 28.0.2 | ≥ 29.0.0, < 29.0.2

References (6)