CVE-2026-42999 Details
Description
An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone RBAC policy enforcer in enforce_call unconditionally merges the raw JSON request body into the policy enforcement dictionary via policy_dict.update(json_input.copy()), overwriting trusted target data that was previously set from database lookups. Because flask.request.get_json is called with force=True, this works regardless of Content-Type or HTTP method. Any authenticated user can inject arbitrary policy target attributes (e.g., user_id, project_id) into the request body to bypass RBAC checks and perform unauthorized operations on resources belonging to other users or projects. This was introduced in commit 5ea59f52 (Rocky/14.0.0).
A vulnerability exists in OpenStack Keystone versions prior to 29.0.2, allowing authenticated users to inject arbitrary policy target attributes via the JSON request body. This injection bypasses role-based access control (RBAC) checks, enabling unauthorized operations on resources belonging to other users or projects. The vulnerability arises because the Keystone RBAC policy enforcer unconditionally merges the raw JSON request body into the policy enforcement dictionary, overwriting trusted target data from database lookups. Exploitation is possible regardless of the Content-Type or HTTP method, due to the use of 'force=True' in the 'get_json' method.
Users with customized policy files will need to update their policies to address the changes introduced by the patch for this vulnerability. Instructions for updating policies are available in the OpenStack Security Advisory OSSA-2026-015.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2026-42999 | redhat-SADP | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2482840 | redhat-SADP | |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42999.json | redhat-SADP | |
| https://bugs.launchpad.net/keystone/+bug/2148398 | [email protected] | ExploitIssue TrackingPatchThird Party Advisory |
| https://security.openstack.org/ossa/OSSA-2026-015.html | [email protected] | PatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | redhat-SADP |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openstack keystone | >= 14.0.0, < 27.0.2 >= 28.0.0, < 28.0.2 >= 29.0.0, < 29.0.2 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Modified | redhat-SADP |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 2, 2026 | Initial Analysis | [email protected] |
| May 28, 2026 | New CVE Received | [email protected] |