CVE-2026-42999High· 8.3▾ TwilightA flaw was found in OpenStack Keystone. This vulnerability allows an authenticated user to bypass Role-Based Access Control (RBAC) checks by injecting arbitrary policy target attributes into the request body. This enables the user to perfo…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 45.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 31.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.3%
Last analysed / modified upstream
0.3% → 0.4%
6 → 8.3
medium → high
A flaw was found in OpenStack Keystone. This vulnerability allows an authenticated user to bypass Role-Based Access Control (RBAC) checks by injecting arbitrary policy target attributes into the request body. This enables the user to perform unauthorized operations on resources belonging to other users or projects. The issue stems from the Keystone RBAC policy enforcer unconditionally merging the raw JSON request body into its policy enforcement dictionary, which overwrites trusted data.
openstack-keystone: OpenStack Keystone: Unauthorized access and privilege escalation via arbitrary policy attribute injection — rated Important by Red Hat. Released 2026-05-28, updated 2026-09-25.
Affected:
No fix planned:
Not affected:
Affected
Affected packages:
keystone >= 14.0.0, < 27.0.2keystone >= 28.0.0, < 28.0.2keystone >= 29.0.0, < 29.0.2Patched in:
keystone 27.0.2keystone 28.0.2keystone 29.0.2Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-44283Medium· 4.3etcd: etcd: Authenticated user can bypass RBAC for unauthorized data access (CVE-2026-44283)
CVE-2026-54770Medium· 6.1WebOb provides objects for HTTP requests and responses
CVE-2026-71491High· 7.5sqlparse is a non-validating SQL parser module for Python
CVE-2024-1313Medium· 6.5grafana: vulnerable to authorization bypass (CVE-2024-1313)
CVE-2026-49825High· 8.2lxml is a library for processing XML and HTML in the Python language
CVE-2026-115877Medium· 5.4twisted: Twisted: HTTP request smuggling via improper header delimiter handling (CVE-2026-115877)