Skip to content
Sign in
6.0 Medium

CVE-2026-42998 An issue was discovered in OpenStack Keystone before 29.0.2

Description

An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone application credential authentication plugin does not verify that the user supplied in the authentication request matches the owner of the application credential. An attacker can authenticate with their own application credential ID and secret while specifying a different user's name and domain in the request body. Keystone issues a token attributed to the victim user. The impersonated token is project-scoped and carries the intersection of the application credential's roles and the victim's actual roles on the project. This enables audit evasion, reading the victim's credentials, and acting as the victim within shared projects.

Affected products and versions

Product Affected versions Fixed in
Keystone 29.0 29.0.0 → < 29.0.2 29.0.2
Keystone 28.0 28.0.0 → < 28.0.2 28.0.2
Keystone 14.0 14.0.0 → < 27.0.2 27.0.2

Other CVEs of Keystone

The 13 CVEs of Keystone →
CVE-2026-90460 An issue was discovered in OpenStack Keystone before 29.0.3 7.6 High CVE-2026-80183 In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every… 7.1 High CVE-2026-80184 In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms (OAuth1 access tokens,… 7.6 High CVE-2026-80182 In OpenStack Keystone before 29.0.3, tokens obtained via OAuth1 access token, application credential, or trust-scoped… 7.6 High
Track this CVE