CVE-2026-42999 — Security Box Score

CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-42999HIGH

OpenStack Keystone — An issue was discovered in OpenStack Keystone before 29.0.2.

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  H  H    8.8   .0033   25.9     —

AFFECTED
  Product   Versions  Fixed
  Keystone  14.0.0 –  —

TIMELINE
  May 1   Reserved by mitre
  May 28  EXPLOIT PUBLISHED — CVE-2026-42999 (OpenStack Keystone). Public exploit reference added.
  May 28  Published (CNA: mitre)
  Jul 23  EXPLOIT PUBLISHED — CVE-2026-42999 (OpenStack Keystone). Public exploit reference added.
  Jul 23  RESCORED — CVE-2026-42999 (OpenStack Keystone). CVSS 6 → 8.8 (NVD).

CWE-863, CWE-639 · CNA: mitre · CVSS v3.1 · 5 references · NVD status: Modified

Description

An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone RBAC policy enforcer in enforce_call unconditionally merges the raw JSON request body into the policy enforcement dictionary via policy_dict.update(json_input.copy()), overwriting trusted target data that was previously set from database lookups. Because flask.request.get_json is called with force=True, this works regardless of Content-Type or HTTP method. Any authenticated user can inject arbitrary policy target attributes (e.g., user_id, project_id) into the request body to bypass RBAC checks and perform unauthorized operations on resources belonging to other users or projects. This was introduced in commit 5ea59f52 (Rocky/14.0.0).

Lifecycle

Complete event history — 5 events, chronological
Date	Event	Detail
May 1, 2026	Reserved	Reserved by mitre
May 28, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-42999 (OpenStack Keystone). Public exploit reference added.
May 28, 2026	Published	Published (CNA: mitre)
July 23, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-42999 (OpenStack Keystone). Public exploit reference added.
July 23, 2026	RESCORED	RESCORED — CVE-2026-42999 (OpenStack Keystone). CVSS 6 → 8.8 (NVD).

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
OpenStack	Keystone	—	14.0.0	—

Weaknesses

CWE-863 · CWE-639

References (5)

https://access.redhat.com/security/cve/CVE-2026-42999
https://bugs.launchpad.net/keystone/+bug/2148398 [Exploit, Issue Tracking, Patch, Third Party Advisory]
https://bugzilla.redhat.com/show_bug.cgi?id=2482840
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42999.json
https://security.openstack.org/ossa/OSSA-2026-015.html [Patch, Vendor Advisory]

Authoritative record: CVE-2026-42999 at cve.org

Vendors: openstack

Weaknesses: CWE-863 · CWE-639

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-42999 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.