6

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-42998

CVE-2026-42998: OpenStack Keystone doesn't verify that the user supplied in the authentication request matches the owner of the application credential

An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone application credential authentication plugin does not verify that the user supplied in the authentication request matches the owner of the application credential. An attacker can authenticate with their own application credential ID and secret while specifying a different user's name and domain in the request body. Keystone issues a token attributed to the victim user. The impersonated token is project-scoped and carries the intersection of the application credential's roles and the victim's actual roles on the project. This enables audit evasion, reading the victim's credentials, and acting as the victim within shared projects.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-42998

CVE-2026-42998:

6

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
keystone	pip	>= 14.0.0, < 27.0.2	27.0.2
keystone	pip	>= 28.0.0, < 28.0.2	28.0.2
keystone	pip	>= 29.0.0, < 29.0.2	29.0.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the application credential authentication process within OpenStack Keystone. The core issue is a failure to properly validate the user identity provided during authentication. The keystone.auth.plugins.core.AppCredInfo._validate_and_normalize_auth_data function was responsible for preparing authentication data. It contained a flaw where it would trust a user object if supplied in the authentication request body (auth_payload). An attacker could exploit this by providing their own valid application credential but including the user ID of a victim in the request. Keystone would then incorrectly issue a token for the victim, but scoped to the attacker's project and roles. This allowed for impersonation, audit evasion, and potential privilege escalation. The fix, identified in commit b4f1eb1f13a7559f771b0f4d46c4c59917e82f01, removes the conditional check and ensures that the user ID is always taken from the application credential itself, effectively ignoring any user information supplied in the request and preventing the impersonation.

Vulnerable functions

AppCredInfo._validate_and_normalize_auth_data

keystone/auth/plugins/core.py

The vulnerability exists in the `_validate_and_normalize_auth_data` method of the `AppCredInfo` class. The original code checked if a 'user' object was present in the `auth_payload`. If it was not, the code would correctly assign the user ID from the application credential. However, if a 'user' object was provided in the payload, the code would use it, allowing an attacker to specify a different user's ID and impersonate them. The patch fixes this by unconditionally setting the user from the application credential's owner, ignoring any user data from the request payload.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.