---
id: CVE-2026-42999
title: >-
  openstack-keystone: OpenStack Keystone: Unauthorized access and privilege
  escalation via arbitrary policy attribute injection (CVE-2026-429…
summary: >-
  A flaw was found in OpenStack Keystone. This vulnerability allows an
  authenticated user to bypass Role-Based Access Control (RBAC) checks by
  injecting arbitrary policy target attributes into the request body. This
  enables the user to perfo…
severity: high
cvss: 8.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L'
cvssSource: vendor
cwe: CWE-639
vendor: Red Hat
product: Red Hat OpenStack Platform 16.2
affected:
  - openstack_platform_13_queens
  - openstack_platform 16.2
  - openstack_platform 17.1
  - openstack_platform 18.0
patched:
  - keystone 27.0.2
  - keystone 28.0.2
  - keystone 29.0.2
published: '2026-05-28'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T16:30:49+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42999.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42999.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-42999'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2482840'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-42999'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-42999'
  - url: 'https://bugs.launchpad.net/keystone/+bug/2148398'
  - url: 'https://security.openstack.org/ossa/OSSA-2026-015.html'
  - url: 'https://github.com/openstack/keystone'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2026-600.yaml
tags:
  - csaf
  - vex
  - red-hat
  - osv
  - pip
  - score-dispute
epss: 0.00329
epssPercentile: 0.25931
aliases:
  - GHSA-2r23-2g6v-2m5f
  - PYSEC-2026-600
ecosystem: pip
scores:
  vendor: 8.3
  osv: 6
ingestedAt: '2026-07-08T18:25:44.604Z'
---

## Overview

A flaw was found in OpenStack Keystone. This vulnerability allows an authenticated user to bypass Role-Based Access Control (RBAC) checks by injecting arbitrary policy target attributes into the request body. This enables the user to perform unauthorized operations on resources belonging to other users or projects. The issue stems from the Keystone RBAC policy enforcer unconditionally merging the raw JSON request body into its policy enforcement dictionary, which overwrites trusted data.

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat OpenStack Platform 13 (Queens), Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1, Red Hat OpenStack Platform 18.0 · no fix planned: Red Hat OpenStack Platform 13 (Queens), Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1, Red Hat OpenStack Platform 18.0 · updated 2026-09-25 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42999.json)

**openstack-keystone: OpenStack Keystone: Unauthorized access and privilege escalation via arbitrary policy attribute injection** — rated Important by Red Hat. Released 2026-05-28, updated 2026-09-25.

Affected:

- Red Hat OpenStack Platform 13 (Queens)
- Red Hat OpenStack Platform 16.2
- Red Hat OpenStack Platform 17.1
- Red Hat OpenStack Platform 18.0

No fix planned:

- Red Hat OpenStack Platform 13 (Queens)
- Red Hat OpenStack Platform 16.2
- Red Hat OpenStack Platform 17.1
- Red Hat OpenStack Platform 18.0

Not affected:

- Red Hat OpenStack Platform 13 (Queens)

## Remediation

Affected

## Package advisory (CVE-2026-42999)

Affected packages:

- `keystone >= 14.0.0, < 27.0.2`
- `keystone >= 28.0.0, < 28.0.2`
- `keystone >= 29.0.0, < 29.0.2`

Patched in:

- `keystone 27.0.2`
- `keystone 28.0.2`
- `keystone 29.0.2`

Source: https://osv.dev/vulnerability/GHSA-2r23-2g6v-2m5f