PT-2026-44464 · Openstack · Keystone

Boris Bobrov · Published 2026-05-28 · Updated 2026-06-16 · CVE-2026-42999

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenStack Keystone versions 14.0.0 through 29.0.1

Description The RBAC policy enforcer in the enforce call() function unconditionally merges the raw JSON request body into the policy enforcement dictionary using policy dict.update(json input.copy()). This process overwrites trusted target data previously retrieved from database lookups. Since flask.request.get json is executed with force=True, the merge occurs regardless of the HTTP method or Content-Type. Consequently, an authenticated user can inject arbitrary policy target attributes, such as user id or project id, into the request body to bypass Role-Based Access Control (RBAC) checks and perform unauthorized operations on resources belonging to other users or projects.

Recommendations Update to version 29.0.2.

Fix

DoS

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-42999

USN-8433-1

Affected Products

Keystone

References · 16

• https://osv.dev/vulnerability/USN-8433-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42999 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-42999 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-42999 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-42999 · Security Note
• https://bugs.launchpad.net/keystone/+bug/2148398 · Patch
• https://ubuntu.com/security/CVE-2026-33551 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-42999 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-42998 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-44394 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-43001 · Vendor Advisory
• https://security.openstack.org/ossa/OSSA-2026-015.html · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-42999 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8433-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-43000 · Vendor Advisory