6.0
Moyenne
CVE-2026-42999 An issue was discovered in OpenStack Keystone before 29.0.2
Description
An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone RBAC policy enforcer in enforce_call unconditionally merges the raw JSON request body into the policy enforcement dictionary via policy_dict.update(json_input.copy()), overwriting trusted target data that was previously set from database lookups. Because flask.request.get_json is called with force=True, this works regardless of Content-Type or HTTP method. Any authenticated user can inject arbitrary policy target attributes (e.g., user_id, project_id) into the request body to bypass RBAC checks and perform unauthorized operations on resources belonging to other users or projects. This was introduced in commit 5ea59f52 (Rocky/14.0.0).
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Keystone 29.0 | 29.0.0 → < 29.0.2 | 29.0.2 |
| Keystone 28.0 | 28.0.0 → < 28.0.2 | 28.0.2 |
| Keystone 14.0 | 14.0.0 → < 27.0.2 | 27.0.2 |
| Red Hat OpenStack Platform 13 (Queens) | Versions non publiées | |
| Red Hat OpenStack Platform 16.2 | Versions non publiées | |
| Red Hat OpenStack Platform 17.1 | Versions non publiées | |
| Red Hat OpenStack Platform 18.0 | Versions non publiées |
Références
- bugs.launchpad.net bugs.launchpad.net
- security.openstack.org security.openstack.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de Keystone
Les 13 CVE de Keystone →
CVE-2026-90460
An issue was discovered in OpenStack Keystone before 29.0.3
7.6
Élevée
CVE-2026-80183
In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every…
7.1
Élevée
CVE-2026-80184
In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms (OAuth1 access tokens,…
7.6
Élevée
CVE-2026-80182
In OpenStack Keystone before 29.0.3, tokens obtained via OAuth1 access token, application credential, or trust-scoped…
7.6
Élevée