{"id":"CVE-2026-42999","aliases":["GHSA-2r23-2g6v-2m5f","PYSEC-2026-600"],"title":"OpenStack Keystone has an Authorization Bypass","summary":"OpenStack Keystone has an Authorization Bypass","severity":"medium","cvss":6,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L","vendor":"keystone","product":"keystone","ecosystem":"pip","affected":["keystone >= 14.0.0, < 27.0.2","keystone >= 28.0.0, < 28.0.2","keystone >= 29.0.0, < 29.0.2"],"patched":["keystone 27.0.2","keystone 28.0.2","keystone 29.0.2"],"published":"2026-05-28","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:51:04.100486004Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-2r23-2g6v-2m5f","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42999"},{"url":"https://access.redhat.com/security/cve/CVE-2026-42999"},{"url":"https://bugs.launchpad.net/keystone/+bug/2148398"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2482840"},{"url":"https://github.com/openstack/keystone"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2026-600.yaml"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42999.json"},{"url":"https://security.openstack.org/ossa/OSSA-2026-015.html"}],"tags":["osv","pip"],"epss":0.00329,"epssPercentile":0.26234,"ingestedAt":"2026-07-08T18:25:44.604Z","slug":"CVE-2026-42999","body":"## Overview\n\nAn issue was discovered in OpenStack Keystone before 29.0.2. The Keystone RBAC policy enforcer in enforce_call unconditionally merges the raw JSON request body into the policy enforcement dictionary via policy_dict.update(json_input.copy()), overwriting trusted target data that was previously set from database lookups. Because flask.request.get_json is called with force=True, this works regardless of Content-Type or HTTP method. Any authenticated user can inject arbitrary policy target attributes (e.g., user_id, project_id) into the request body to bypass RBAC checks and perform unauthorized operations on resources belonging to other users or projects. This was introduced in commit 5ea59f52 (Rocky/14.0.0).\n\n## Affected packages\n\n- `keystone >= 14.0.0, < 27.0.2`\n- `keystone >= 28.0.0, < 28.0.2`\n- `keystone >= 29.0.0, < 29.0.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `keystone 27.0.2`\n- `keystone 28.0.2`\n- `keystone 29.0.2`","depth":"sunlit","depthScore":33,"depthScoreParts":{"impact":33,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}