UBUNTU-CVE-2026-42998

An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone application credential authentication plugin does not verify that the user supplied in the authentication request matches the owner of the application credential. An attacker can authenticate with their own application...

CVE-2026-42999

An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone RBAC policy enforcer in enforcecall unconditionally merges the raw JSON request body into the policy enforcement dictionary via policydict.updatejsoninput.copy, overwriting trusted target data that was previously set from...

UBUNTU-CVE-2026-42999

An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone RBAC policy enforcer in enforcecall unconditionally merges the raw JSON request body into the policy enforcement dictionary via policydict.updatejsoninput.copy, overwriting trusted target data that was previously set from...

CVE-2026-44394

An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone federated token rescoping mechanism does not propagate the original token's expiry to the newly issued token. When a federated user rescopes a token via POST /v3/auth/tokens, the handlescopedtoken function in the mapped...

CVE-2026-43000

An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation vulnerability, an attacker with the member role on a project can escalate to admin by chaining unrestricted application credentials with Keystone trusts. The impersonated token...

UBUNTU-CVE-2026-43000

An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation vulnerability, an attacker with the member role on a project can escalate to admin by chaining unrestricted application credentials with Keystone trusts. The impersonated token...

GHSA-HHQ2-3832-XXCV vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.1-fips, openstack-keystone-2025.2, openstack-keystone-2025.1, openstack-keystone-2025.2-fips, openstack-keystone-2026.1...

CVE-2026-43001 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.1-fips, openstack-keystone-2025.2, openstack-keystone-2025.1, openstack-keystone-2025.2-fips, openstack-keystone-2026.1...

CVE-2026-42998

An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone application credential authentication plugin does not verify that the user supplied in the authentication request matches the owner of the application credential. An attacker can authenticate with their own application...

PT-2026-44463

Name of the Vulnerable Software and Affected Versions OpenStack Keystone versions prior to 29.0.2 Description The application credential authentication plugin fails to verify if the user provided in the authentication request is the actual owner of the application credential. An attacker can use...

CVE-2026-42998

An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone application credential authentication plugin does not verify that the user supplied in the authentication request matches the owner of the application credential. An attacker can authenticate with their own application...

CVE-2026-42998

An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone application credential authentication plugin does not verify that the user supplied in the authentication request matches the owner of the application credential. An attacker can authenticate with their own application...

Insufficient Session Expiration

Overview keystone is a package that provides authentication, authorization and service discovery mechanisms via HTTP primarily for use by projects in the OpenStack family. Affected versions of this package are vulnerable to Insufficient Session Expiration via the federated token rescoping process...

OpenStack Keystone security vulnerabilities

OpenStack Keystone is a core authentication component library of the OpenStack open-source project. Versions of OpenStack Keystone prior to 29.0.2 contained security vulnerabilities. These vulnerabilities stemmed from the application credential authentication plugin not verifying user identities...

a10-octavia (>=1.0.0.0a1, <=2.2.0) potentially affected by CVE-2026-42998 via keystone (>=15.0.1, <=18.0.0)

keystone PYPI version =15.0.1, =1.0.0.0a1, =2.2.0 Source cves: CVE-2026-42998 Source advisory: MEND:CVE-2026-42998...

a10-octavia (>=1.0.0.0a1, <=2.2.0) potentially affected by CVE-2026-44394 via keystone (>=15.0.1, <=18.0.0)

keystone PYPI version =15.0.1, =1.0.0.0a1, =2.2.0 Source cves: CVE-2026-44394 Source advisory: MEND:CVE-2026-44394...

a10-octavia (>=1.0.0.0a1, <=2.2.0) potentially affected by CVE-2026-44394 via keystone (>=15.0.1, <=18.0.0)

keystone PYPI version =15.0.1, =1.0.0.0a1, =2.2.0 Source cves: CVE-2026-44394 Source advisory: SNYK:PYTHON-KEYSTONE-17671312...

a10-octavia (>=1.0.0.0a1, <=2.2.0) potentially affected by CVE-2026-42998 via keystone (>=15.0.1, <=18.0.0)

keystone PYPI version =15.0.1, =1.0.0.0a1, =2.2.0 Source cves: CVE-2026-42998 Source advisory: SNYK:PYTHON-KEYSTONE-17671328...

CVE-2026-44394

An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone federated token rescoping mechanism does not propagate the original token's expiry to the newly issued token. When a federated user rescopes a token via POST /v3/auth/tokens, the handlescopedtoken function in the mapped...

CVE-2026-42999

An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone RBAC policy enforcer in enforcecall unconditionally merges the raw JSON request body into the policy enforcement dictionary via policydict.updatejsoninput.copy, overwriting trusted target data that was previously set from...