CVE-2026-42999: openstack keystone Incorrect Authorization
Vulnerability summary
CVE-2026-42999 is a high (CVSS 8.8) Incorrect Authorization vulnerability in openstack keystone. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 26.1% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 6, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 0 · Related 2Timeline
- 28-05-2026PublishedVulnerability first disclosed.
- 24-07-2026Last modifiedVulnerability information updated.
Description
An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone RBAC policy enforcer in enforce_call unconditionally merges the raw JSON request body into the policy enforcement dictionary via policy_dict.update(json_input.copy()), overwriting trusted target data that was previously set from database lookups. Because flask.request.get_json is called with force=True, this works regardless of Content-Type or HTTP method. Any authenticated user can inject arbitrary policy target attributes (e.g., user_id, project_id) into the request body to bypass RBAC checks and perform unauthorized operations on resources belonging to other users or projects. This was introduced in commit 5ea59f52 (Rocky/14.0.0).
CVSS metrics
6 scores · 6 sources · 1 version- CVE.orgCNA6.0MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:LDiffers
- OSV · PypiEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated6.0MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:LDiffers
EPSS trend
Probability
0.33%
Chance of exploitation in the next 30 days
Percentile
26%
Versus all other CVEs
30-day change
Decrease -0.09 pp
From 0.42% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (bugs.launchpad.net)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
- CWE-639Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Affected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard6 products
- openstack-keystone-2025.1< 27.0.1_git20260618-r6
- openstack-keystone-2025.1-fips< 27.0.1_git20260618-r7
- openstack-keystone-2025.2< 28.0.1_git20260618-r5
- openstack-keystone-2025.2-fips< 28.0.1_git20260618-r5
- openstack-keystone-2026.1< 29.0.1_git20260616-r6
Debian1 product
- keystone< 2:22.0.2-0+deb12u3 | < 2:27.0.0-3+deb13u4 | < 2:29.0.1-2
Openstack1 product
- keystone≥ 14.0.0, < 27.0.2 | ≥ 28.0.0, < 28.0.2 | ≥ 29.0.0, < 29.0.2
PyPI1 product
- keystone≥ 14.0.0, < 27.0.2 | ≥ 28.0.0, < 28.0.2 | ≥ 29.0.0, < 29.0.2
Ubuntu1 product
- keystoneAll versions (No fix recorded) | < 2:21.0.1-0ubuntu2.4 | < 2:25.0.0-0ubuntu1.4 | < 2:28.0.0-0ubuntu1.3 | < 2:29.0.0-0ubuntu1.2
5 vendors · 10 products
