CVE-2026-42999

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-42999
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42999.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-42999
Aliases
Downstream
Related
Published
2026-05-28T00:00:00Z
Modified
2026-07-08T08:13:26.807163108Z
Severity
  • 6.0 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L CVSS Calculator
Summary
[none]
Details

An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone RBAC policy enforcer in enforcecall unconditionally merges the raw JSON request body into the policy enforcement dictionary via policydict.update(jsoninput.copy()), overwriting trusted target data that was previously set from database lookups. Because flask.request.getjson is called with force=True, this works regardless of Content-Type or HTTP method. Any authenticated user can inject arbitrary policy target attributes (e.g., userid, projectid) into the request body to bypass RBAC checks and perform unauthorized operations on resources belonging to other users or projects. This was introduced in commit 5ea59f52 (Rocky/14.0.0).

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "14.0.0"
                },
                {
                    "fixed": "27.0.2"
                },
                {
                    "introduced": "28.0.0"
                },
                {
                    "fixed": "28.0.2"
                },
                {
                    "introduced": "29.0.0"
                },
                {
                    "fixed": "29.0.2"
                }
            ]
        },
        {
            "source": "CPE_FIELD",
            "extracted_events": [
                {
                    "introduced": "14.0.0"
                },
                {
                    "fixed": "27.0.2"
                },
                {
                    "introduced": "28.0.0"
                },
                {
                    "fixed": "28.0.2"
                },
                {
                    "introduced": "29.0.0"
                },
                {
                    "fixed": "29.0.2"
                }
            ]
        },
        {
            "source": "DESCRIPTION",
            "extracted_events": [
                {
                    "fixed": "29.0.2"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42999.json",
    "cna_assigner": "mitre",
    "cwe_ids": [
        "CWE-863"
    ]
}
References

Affected packages

Git / github.com/openstack/keystone

Affected ranges

Type
GIT
Repo
https://github.com/openstack/keystone
Events
Introduced
c767e254979c96858a81cc4bbe8d9773d4dd539b
Fixed
b896b71557ce8370c442fe05818a74d7a9a623a8
Introduced
a568938e0c967a56ade269c93f42718008487b14
Fixed
3dfbbe7b9bd11dcd64420da0e4eda48b637f4a70
Introduced
3526925ae34a66e626bec985628a421a7694168e
Fixed
7b9f39226744b8db50a6d702cc5f715fc9c17f37
Database specific 
{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "14.0.0"
        },
        {
            "fixed": "27.0.2"
        },
        {
            "introduced": "28.0.0"
        },
        {
            "fixed": "28.0.2"
        },
        {
            "introduced": "29.0.0"
        },
        {
            "fixed": "29.0.2"
        }
    ]
}

Affected versions

28.*
28.0.0
28.0.0.0rc1
28.0.1
29.*
29.0.0
29.0.0.0rc1
29.0.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42999.json"