{"id":"CVE-2026-42999","title":"openstack-keystone: OpenStack Keystone: Unauthorized access and privilege escalation via arbitrary policy attribute injection (CVE-2026-429…","summary":"A flaw was found in OpenStack Keystone. This vulnerability allows an authenticated user to bypass Role-Based Access Control (RBAC) checks by injecting arbitrary policy target attributes into the request body. This enables the user to perfo…","severity":"high","cvss":8.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","cvssSource":"vendor","cwe":"CWE-639","vendor":"Red Hat","product":"Red Hat OpenStack Platform 16.2","affected":["openstack_platform_13_queens","openstack_platform 16.2","openstack_platform 17.1","openstack_platform 18.0"],"patched":["keystone 27.0.2","keystone 28.0.2","keystone 29.0.2"],"published":"2026-05-28","updated":"2026-09-25","sourceUpdated":"2026-09-25T16:30:49+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42999.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42999.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-42999"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2482840"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42999"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42999"},{"url":"https://bugs.launchpad.net/keystone/+bug/2148398"},{"url":"https://security.openstack.org/ossa/OSSA-2026-015.html"},{"url":"https://github.com/openstack/keystone"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2026-600.yaml"}],"tags":["csaf","vex","red-hat","osv","pip","score-dispute"],"epss":0.00329,"epssPercentile":0.25931,"aliases":["GHSA-2r23-2g6v-2m5f","PYSEC-2026-600"],"ecosystem":"pip","scores":{"vendor":8.3,"osv":6},"ingestedAt":"2026-07-08T18:25:44.604Z","slug":"CVE-2026-42999","body":"## Overview\n\nA flaw was found in OpenStack Keystone. This vulnerability allows an authenticated user to bypass Role-Based Access Control (RBAC) checks by injecting arbitrary policy target attributes into the request body. This enables the user to perform unauthorized operations on resources belonging to other users or projects. The issue stems from the Keystone RBAC policy enforcer unconditionally merging the raw JSON request body into its policy enforcement dictionary, which overwrites trusted data.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Red Hat OpenStack Platform 13 (Queens), Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1, Red Hat OpenStack Platform 18.0 · no fix planned: Red Hat OpenStack Platform 13 (Queens), Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1, Red Hat OpenStack Platform 18.0 · updated 2026-09-25 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42999.json)\n\n**openstack-keystone: OpenStack Keystone: Unauthorized access and privilege escalation via arbitrary policy attribute injection** — rated Important by Red Hat. Released 2026-05-28, updated 2026-09-25.\n\nAffected:\n\n- Red Hat OpenStack Platform 13 (Queens)\n- Red Hat OpenStack Platform 16.2\n- Red Hat OpenStack Platform 17.1\n- Red Hat OpenStack Platform 18.0\n\nNo fix planned:\n\n- Red Hat OpenStack Platform 13 (Queens)\n- Red Hat OpenStack Platform 16.2\n- Red Hat OpenStack Platform 17.1\n- Red Hat OpenStack Platform 18.0\n\nNot affected:\n\n- Red Hat OpenStack Platform 13 (Queens)\n\n## Remediation\n\nAffected\n\n## Package advisory (CVE-2026-42999)\n\nAffected packages:\n\n- `keystone >= 14.0.0, < 27.0.2`\n- `keystone >= 28.0.0, < 28.0.2`\n- `keystone >= 29.0.0, < 29.0.2`\n\nPatched in:\n\n- `keystone 27.0.2`\n- `keystone 28.0.2`\n- `keystone 29.0.2`\n\nSource: https://osv.dev/vulnerability/GHSA-2r23-2g6v-2m5f","depth":"twilight","depthScore":46,"depthScoreParts":{"impact":45.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":211321,"id":"CVE-2026-42999","ts":1790408695022,"field":"cvss","old":"6","new":"8.3"},{"seq":211320,"id":"CVE-2026-42999","ts":1790408695022,"field":"severity","old":"medium","new":"high"}]}