[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-42999":6},{"stargazers_count":4,"fetched_at":5},7,"2026-08-01T06:21:05.817Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":26,"aliases":36,"duplicate_of":9,"upstream":39,"downstream":40,"duplicates":47,"related":48,"reserved_at":9,"published_at":51,"modified_at":52,"state":53,"summary":54,"references_raw":62,"kevs":113,"epss":114,"epss_history":117,"metrics":232,"affected":247},"CVE-2026-42999","An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone RBAC policy enforcer in enforce_call unconditionally merges the raw JSON request body into the policy enforcement dictionary via policy_dict.update(json_input.copy()), overwriting trusted target data that was previously set from database lookups. Because flask.request.get_json is called with force=True, this works regardless of Content-Type or HTTP method. Any authenticated user can inject arbitrary policy target attributes (e.g., user_id, project_id) into the request body to bypass RBAC checks and perform unauthorized operations on resources belonging to other users or projects. This was introduced in commit 5ea59f52 (Rocky/14.0.0).",null,[11,20],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-863","Incorrect Authorization","The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.","weakness","Incomplete","Class","High",[],{"_key":21,"id":21,"name":22,"description":23,"type":15,"status":16,"abstraction":24,"likelihood_of_exploit":18,"capec":25},"CWE-639","Authorization Bypass Through User-Controlled Key","The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.","Base",[],[27],{"_key":28,"name":29,"source":30,"url":31,"maturity":32,"reliability_score":33,"verified":34,"type":9,"platforms":35,"requires_auth":9,"exploitdb":9,"metasploit":9},"REF_54353E5E536F2EA3","Exploit Reference (bugs.launchpad.net)","reference","https://bugs.launchpad.net/keystone/+bug/2148398","unknown",0.2,false,[],[37,38],"GHSA-2r23-2g6v-2m5f","PYSEC-2026-600",[],[41,43,45],{"_key":42},"DEBIAN-CVE-2026-42999",{"_key":44},"USN-8433-1",{"_key":46},"UBUNTU-CVE-2026-42999",[],[49],{"_key":50},"CGA-8349-J6V3-QW75","2026-05-28T00:00:00.000Z","2026-07-15T00:56:27.705Z","Analyzed",{"cisa_kev":34,"cisa_ransomware":34,"cisa_vendor":9,"epss_severity":55,"epss_score":56,"severity":57,"severity_score":58,"severity_version":59,"severity_source":60,"severity_vector":61,"severity_status":53},"low",0.00329,"high",8.8,"v3.1","nvd","CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",[63,74,79,85,90,95,100,105,109],{"url":31,"sources":64,"tags":67},[65,60,66],"cve.org","osv_pypi",[68,69,70,71,72,73],"Exploit","Issue Tracking","Third Party Advisory","Patch","WEB","FIX",{"url":75,"sources":76,"tags":77},"https://security.openstack.org/ossa/OSSA-2026-015.html",[65,60,66],[78,71,72,73],"Vendor Advisory",{"url":80,"sources":81,"tags":82},"https://access.redhat.com/security/cve/CVE-2026-42999",[65,66],[83,84,72],"VDB Entry","X Refsource REDHAT",{"url":86,"sources":87,"tags":88},"https://bugzilla.redhat.com/show_bug.cgi?id=2482840",[65,66],[69,84,72,89],"REPORT",{"url":91,"sources":92,"tags":93},"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42999.json",[65,66],[94,72],"X Sadp Csaf Vex",{"url":96,"sources":97,"tags":98},"https://nvd.nist.gov/vuln/detail/CVE-2026-42999",[66],[99],"Advisory",{"url":101,"sources":102,"tags":103},"https://github.com/openstack/keystone",[66],[104],"PACKAGE",{"url":106,"sources":107,"tags":108},"https://github.com/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2026-600.yaml",[66],[72],{"url":110,"sources":111,"tags":112},"https://github.com/advisories/GHSA-2r23-2g6v-2m5f",[66],[99],[],{"date":115,"score":56,"percentile":116},"2026-07-05",0.24862,[118,122,125,128,131,134,138,141,144,147,150,153,155,157,160,163,166,169,173,176,179,182,185,188,191,194,198,201,204,207,210,213,216,219,222,225,228,231],{"date":119,"score":120,"percentile":121},"2026-05-29",0.00034,0.10452,{"date":123,"score":120,"percentile":124},"2026-05-30",0.10447,{"date":126,"score":120,"percentile":127},"2026-05-31",0.10429,{"date":129,"score":120,"percentile":130},"2026-06-01",0.10409,{"date":132,"score":120,"percentile":133},"2026-06-02",0.10405,{"date":135,"score":136,"percentile":137},"2026-06-03",0.00041,0.12679,{"date":139,"score":136,"percentile":140},"2026-06-04",0.12697,{"date":142,"score":136,"percentile":143},"2026-06-05",0.12781,{"date":145,"score":136,"percentile":146},"2026-06-06",0.12785,{"date":148,"score":136,"percentile":149},"2026-06-07",0.12748,{"date":151,"score":136,"percentile":152},"2026-06-08",0.12666,{"date":154,"score":136,"percentile":140},"2026-06-09",{"date":156,"score":136,"percentile":149},"2026-06-10",{"date":158,"score":136,"percentile":159},"2026-06-11",0.12783,{"date":161,"score":136,"percentile":162},"2026-06-12",0.12878,{"date":164,"score":136,"percentile":165},"2026-06-13",0.12888,{"date":167,"score":136,"percentile":168},"2026-06-14",0.1287,{"date":170,"score":171,"percentile":172},"2026-06-15",0.00246,0.1563,{"date":174,"score":171,"percentile":175},"2026-06-16",0.15653,{"date":177,"score":171,"percentile":178},"2026-06-17",0.15652,{"date":180,"score":171,"percentile":181},"2026-06-18",0.1566,{"date":183,"score":171,"percentile":184},"2026-06-19",0.15648,{"date":186,"score":171,"percentile":187},"2026-06-20",0.1564,{"date":189,"score":171,"percentile":190},"2026-06-21",0.15628,{"date":192,"score":171,"percentile":193},"2026-06-22",0.15617,{"date":195,"score":196,"percentile":197},"2026-06-23",0.00254,0.16452,{"date":199,"score":196,"percentile":200},"2026-06-24",0.16473,{"date":202,"score":196,"percentile":203},"2026-06-25",0.1657,{"date":205,"score":196,"percentile":206},"2026-06-26",0.16596,{"date":208,"score":196,"percentile":209},"2026-06-27",0.16633,{"date":211,"score":196,"percentile":212},"2026-06-28",0.16597,{"date":214,"score":196,"percentile":215},"2026-06-29",0.16592,{"date":217,"score":56,"percentile":218},"2026-06-30",0.24702,{"date":220,"score":56,"percentile":221},"2026-07-01",0.24812,{"date":223,"score":56,"percentile":224},"2026-07-02",0.24836,{"date":226,"score":56,"percentile":227},"2026-07-03",0.24834,{"date":229,"score":56,"percentile":230},"2026-07-04",0.24845,{"date":115,"score":56,"percentile":116},[233,240,245],{"source":65,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":234,"cvss_v4_0":9},{"baseScore":235,"baseSeverity":236,"vectorString":237,"impactScore":238,"exploitabilityScore":239},6,"MEDIUM","CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",6.2,4.6,{"source":60,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":241,"cvss_v4_0":9},{"baseScore":58,"baseSeverity":242,"vectorString":61,"impactScore":243,"exploitabilityScore":244},"HIGH",9.8,7.2,{"source":66,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":246,"cvss_v4_0":9},{"baseScore":58,"baseSeverity":9,"vectorString":61,"impactScore":243,"exploitabilityScore":244},[248,270],{"ecosystem":9,"name":249,"vendor":250,"product":251,"cpe_part":252,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":253},"Keystone","openstack","keystone","a",[254,262,266],{"version":255,"is_range":256,"range_type":257,"version_start":258,"version_start_type":259,"version_end":260,"version_end_type":261,"fixed_in":9},">= 14.0.0, \u003C 27.0.2",true,"cpe","14.0.0","including","27.0.2","excluding",{"version":263,"is_range":256,"range_type":257,"version_start":264,"version_start_type":259,"version_end":265,"version_end_type":261,"fixed_in":9},">= 28.0.0, \u003C 28.0.2","28.0.0","28.0.2",{"version":267,"is_range":256,"range_type":257,"version_start":268,"version_start_type":259,"version_end":269,"version_end_type":261,"fixed_in":9},">= 29.0.0, \u003C 29.0.2","29.0.0","29.0.2",{"ecosystem":271,"name":251,"vendor":271,"product":251,"cpe_part":9,"purl_type":272,"purl_namespace":9,"purl_name":251,"source":9,"versions":273},"PyPI","pypi",[274,277,279],{"version":275,"is_range":256,"range_type":276,"version_start":258,"version_start_type":259,"version_end":260,"version_end_type":261,"fixed_in":9},"gte14_0_0_lt27_0_2","ecosystem",{"version":278,"is_range":256,"range_type":276,"version_start":264,"version_start_type":259,"version_end":265,"version_end_type":261,"fixed_in":9},"gte28_0_0_lt28_0_2",{"version":280,"is_range":256,"range_type":276,"version_start":268,"version_start_type":259,"version_end":269,"version_end_type":261,"fixed_in":9},"gte29_0_0_lt29_0_2"]