CVE-2026-42998 Details
Description
An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone application credential authentication plugin does not verify that the user supplied in the authentication request matches the owner of the application credential. An attacker can authenticate with their own application credential ID and secret while specifying a different user's name and domain in the request body. Keystone issues a token attributed to the victim user. The impersonated token is project-scoped and carries the intersection of the application credential's roles and the victim's actual roles on the project. This enables audit evasion, reading the victim's credentials, and acting as the victim within shared projects.
A vulnerability in OpenStack Keystone versions prior to 29.0.2 allows for user impersonation via the application credential authentication plugin. The vulnerability arises because the plugin does not verify that the user specified in the authentication request belongs to the owner of the application credential. This flaw enables an attacker to authenticate using their own application credential ID and secret while falsely representing another user's name and domain. As a result, Keystone issues a token associated with the victim user, which can be used to evade audits, access the victim's credentials, and act on their behalf in shared projects. Additionally, this impersonation can be combined with trusts to escalate privileges from member to admin within a project.
Users can update to OpenStack Keystone versions 29.0.2 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://bugs.launchpad.net/keystone/+bug/2148477 | [email protected] | ExploitIssue TrackingPatchThird Party Advisory |
| https://security.openstack.org/ossa/OSSA-2026-015.html | [email protected] | PatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openstack keystone | >= 14.0.0, < 27.0.2 >= 28.0.0, < 28.0.2 >= 29.0.0, < 29.0.2 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 2, 2026 | Initial Analysis | [email protected] |
| May 28, 2026 | New CVE Received | [email protected] |