CVE-2026-42998 - openstack-keystone: OpenStack Keystone: User impersonation and unauthorized access via insufficient application credential verification.

Back Back to CVE browser

HIGH

openstack-keystone: OpenStack Keystone: User impersonation and unauthorized access via insufficient application credential verification.

Published May 28, 2026

8.8

HIGH

CVSS 3.1

EPSS 0.40%

Description

An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone application credential authentication plugin does not verify that the user supplied in the authentication request matches the owner of the application credential. An attacker can authenticate with their own application credential ID and secret while specifying a different user's name and domain in the request body. Keystone issues a token attributed to the victim user. The impersonated token is project-scoped and carries the intersection of the application credential's roles and the victim's actual roles on the project. This enables audit evasion, reading the victim's credentials, and acting as the victim within shared projects.

Affected products

Vendor OpenStack Product Keystone Default
unaffected
- Version
  14.0.0
  Status
  affected
  Constraints
  <27.0.2
- Version
  28.0.0
  Status
  affected
  Constraints
  <28.0.2
- Version
  29.0.0
  Status
  affected
  Constraints
  <29.0.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

OpenStack

Keystone

unaffected

Version	Status	Constraints
14.0.0	affected	<27.0.2
28.0.0	affected	<28.0.2
29.0.0	affected	<29.0.2

Red Hat OpenStack Platform 13 (Queens)

rhosp13/openstack-keystone

Fix deferred
Red Hat OpenStack Platform 16.2

openstack-keystone

Fix deferred
Red Hat OpenStack Platform 16.2

rhosp-rhel8/openstack-keystone

Fix deferred
Red Hat OpenStack Platform 17.1

openstack-keystone

Fix deferred
Red Hat OpenStack Platform 17.1

rhosp-rhel9/openstack-keystone

Fix deferred
Red Hat OpenStack Platform 18.0

openstack-keystone

Fix deferred
Red Hat OpenStack Platform 18.0

rhoso/openstack-keystone-rhel9

Fix deferred

Product	Package	State	Advisory
Red Hat OpenStack Platform 13 (Queens)	rhosp13/openstack-keystone	Fix deferred	n/a
Red Hat OpenStack Platform 16.2	openstack-keystone	Fix deferred	n/a
Red Hat OpenStack Platform 16.2	rhosp-rhel8/openstack-keystone	Fix deferred	n/a
Red Hat OpenStack Platform 17.1	openstack-keystone	Fix deferred	n/a
Red Hat OpenStack Platform 17.1	rhosp-rhel9/openstack-keystone	Fix deferred	n/a
Red Hat OpenStack Platform 18.0	openstack-keystone	Fix deferred	n/a
Red Hat OpenStack Platform 18.0	rhoso/openstack-keystone-rhel9	Fix deferred	n/a

Remediation

Red Hat statement

This MODERATE impersonation vulnerability in Keystone's application credential plugin allows authenticated users to obtain tokens attributed to other users. Exploitation requires high complexity (valid app credentials and shared project context). Impact is limited to the intersection of attacker's app credential roles and victim's actual project roles. Affects versions before 29.0.2.

Metrics

0.40% 0.00404

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 4, 2026.

EPSS probability 0.00404

Score over time

May-Oct 2026

EPSS v4
EPSS v5

Percentile over time

EPSS v4
EPSS v5

Table of values (3 key points)

Flat stretches are collapsed. Showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 4, 2026	0.40% (0.00404)	32.32th	v5 (v2026.06.15)
Jun 15, 2026	0.30% (0.00298)	21.26th	v5 (v2026.06.15)
May 29, 2026	0.06% (0.00058)	18.32th	v4 (v2025.03.14)

Weaknesses (2)

CWE-303

CWE-863

Incorrect Authorization

References (8)

https://access.redhat.com/security/cve/CVE-2026-42998
Vendor Advisory
https://bugs.launchpad.net/keystone/+bug/2148477
ExploitIssue TrackingPatchThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2482825
Issue Tracking
https://github.com/advisories/GHSA-8f8m-wrvr-wcvf
Advisory
https://github.com/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2026-599.yaml
https://nvd.nist.gov/vuln/detail/CVE-2026-42998
https://security.openstack.org/ossa/OSSA-2026-015.html
PatchVendor Advisory
https://www.cve.org/CVERecord?id=CVE-2026-42998

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2026-42998		Vendor Advisory
https://bugs.launchpad.net/keystone/+bug/2148477		ExploitIssue TrackingPatchThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2482825		Issue Tracking
https://github.com/advisories/GHSA-8f8m-wrvr-wcvf		Advisory
https://github.com/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2026-599.yaml
https://nvd.nist.gov/vuln/detail/CVE-2026-42998
https://security.openstack.org/ossa/OSSA-2026-015.html		PatchVendor Advisory
https://www.cve.org/CVERecord?id=CVE-2026-42998