PT-2026-44463 · Openstack · Keystone

Boris Bobrov · Published 2026-05-28 · Updated 2026-06-16 · CVE-2026-42998

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenStack Keystone versions prior to 29.0.2

Description The application credential authentication plugin fails to verify if the user provided in the authentication request is the actual owner of the application credential. An attacker can use their own application credential ID and secret while specifying a different user's name and domain in the request body. This results in the issuance of a project-scoped token attributed to the victim user, containing the intersection of the application credential's roles and the victim's roles within the project. This flaw allows for audit evasion, access to the victim's credentials, and the ability to act as the victim in shared projects.

Recommendations Update to version 29.0.2.

Fix

DoS

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-42998

USN-8433-1

Affected Products

Keystone

References · 16

• https://osv.dev/vulnerability/USN-8433-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-42998 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33551 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-42999 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-42998 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-44394 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42998 · Security Note
• https://ubuntu.com/security/CVE-2026-43001 · Vendor Advisory
• https://bugs.launchpad.net/keystone/+bug/2148477 · Patch
• https://security.openstack.org/ossa/OSSA-2026-015.html · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-42998 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-42998 · Security Note
• https://ubuntu.com/security/notices/USN-8433-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-42998 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-43000 · Vendor Advisory