CVE-2026-42999

An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone RBAC policy enforcer in enforce_call unconditionally merges the raw JSON request body into the policy enforcement dictionary via policy_dict.update(json_input.copy()), overwriting trusted target data that was previously set from database lookups. Because flask.request.get_json is called with force=True, this works regardless of Content-Type or HTTP method. Any authenticated user can inject arbitrary policy target attributes (e.g., user_id, project_id) into the request body to bypass RBAC checks and perform unauthorized operations on resources belonging to other users or projects. This was introduced in commit 5ea59f52 (Rocky/14.0.0).

• CWE-863
• CWE-639

• https://bugs.launchpad.net/keystone/+bug/2148398Exploit, Issue Tracking, Patch, Third Party Advisory
• https://security.openstack.org/ossa/OSSA-2026-015.htmlPatch, Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2026-42999
• https://bugzilla.redhat.com/show_bug.cgi?id=2482840
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42999.json

Published

May 28, 2026

Last Modified

Jul 23, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-42992Heap-based buffer overflow in Remote Desktop Client allows a…7.5
• CVE-2026-42993Heap-based buffer overflow in Remote Desktop Client allows a…7.5
• CVE-2026-42994Bitwarden CLI 2026.4.0 from 2026-04-22T21:57Z to 2026-04-22T…9.8
• CVE-2026-42996JS8Call through 2.3.1 and JS8Call-improved before 3.0 have a…10
• CVE-2026-42997An issue was discovered in idrac in OpenStack Ironic before …7.7
• CVE-2026-42998An issue was discovered in OpenStack Keystone before 29.0.2.…8.8
• CVE-2026-4300The Robo Gallery plugin for WordPress is vulnerable to Store…6.4
• CVE-2026-43000An issue was discovered in OpenStack Keystone before 29.0.2.…8.8
• CVE-2026-43001An issue was discovered in OpenStack Keystone before 29.0.2.…8
• CVE-2026-43002An issue was discovered in OpenStack Horizon 25.6 and 25.7 b…5.3
• CVE-2026-43003An issue was discovered in OpenStack ironic-python-agent 1.0…7.5
• CVE-2026-43004In the Linux kernel, the following vulnerability has been re…5.5