Vulnerability · Published May 28, 2026 · Assigned by mitre

CVE-2026-42999

Medium 6.0

In plain English

A medium-severity incorrect authorization in Keystone from OpenStack. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.0Medium

Exploit odds (30 days)0.3%top 73.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone RBAC policy enforcer in enforce_call unconditionally merges the raw JSON request body into the policy enforcement dictionary via policy_dict.update(json_input.copy()), overwriting trusted target data that was previously set from database lookups. Because flask.request.get_json is called with force=True, this works regardless of Content-Type or HTTP method. Any authenticated user can inject arbitrary policy target attributes (e.g., user_id, project_id) into the request body to bypass RBAC checks and perform unauthorized operations on resources belonging to other users or projects. This was introduced in commit 5ea59f52 (Rocky/14.0.0).

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	keystone	2:22.0.2-0+deb12u3	DEBIAN-CVE-2026-42999
Debian:13	keystone	2:27.0.0-3+deb13u4	DEBIAN-CVE-2026-42999
Debian:14	keystone	2:29.0.1-2	DEBIAN-CVE-2026-42999
PyPI	keystone	27.0.2, 28.0.2, 29.0.2	PYSEC-2026-600
PyPI	keystone	27.0.2	GHSA-2r23-2g6v-2m5f
PyPI	keystone	28.0.2	GHSA-2r23-2g6v-2m5f
PyPI	keystone	29.0.2	GHSA-2r23-2g6v-2m5f
Ubuntu:22.04:LTS	keystone	2:21.0.1-0ubuntu2.4	UBUNTU-CVE-2026-42999
Ubuntu:24.04:LTS	keystone	2:25.0.0-0ubuntu1.4	UBUNTU-CVE-2026-42999
Ubuntu:25.10	keystone	2:28.0.0-0ubuntu1.3	UBUNTU-CVE-2026-42999
Ubuntu:26.04:LTS	keystone	2:29.0.0-0ubuntu1.2	UBUNTU-CVE-2026-42999

Affected products (as reported)

Vendor	Product	Versions
OpenStack	Keystone	14.0.0 – before 27.0.228.0.0 – before 28.0.229.0.0 – before 29.0.2

Weakness: CWE-863, CWE-639 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L

References

https://bugs.launchpad.net/keystone/+bug/2148398
https://security.openstack.org/ossa/OSSA-2026-015.html
https://access.redhat.com/security/cve/CVE-2026-42999 vdb-entry, x_refsource_REDHAT
RHBZ#2482840 issue-tracking, x_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42999.json x_sadp-csaf-vex