Auth bypass in OpenStack Keystone
CVE-2026-42998
An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone application credential authentication plugin does not verify that the user supplied in the authentication request matches the owner of the application credential. An attacker can authenticate with their own application credential ID and secret while specifying a different user's name and domain in the request body. Keystone issues a token attributed to the victim user. The impersonated token is project-scoped and carries the intersection of the application credential's roles and the victim's actual roles on the project. This enables audit evasion, reading the victim's credentials, and acting as the victim within shared projects.
Vulnerability class: Broken Access Control
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.0 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L.
EPSS exploit prediction
EPSS: 0.004 (33.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 33rd percentile — 33.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.004 · change: +0.001
Affected products
- OpenStack Keystone — versions 14.0.0, 28.0.0, 29.0.0
Weakness classification (CWE)
References
- bugs.launchpad.net/keystone/+bug/2148477 (Exploit, Patch, Third Party Advisory, Issue Tracking)
- security.openstack.org/ossa/OSSA-2026-015.html (Patch, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-42998?
- CVE-2026-42998 is a medium-severity vulnerability in OpenStack Keystone, classified under Incorrect Authorization. CVSS score: 6.0/10. Published 2026-05-28.
- How severe is CVE-2026-42998?
- Medium severity. CVSS v3 base score is 6.0 out of 10.