)]}'
{"id":"openstack%2Fkeystone~990489","triplet_id":"openstack%2Fkeystone~master~I295d1ac27faad05a680bb2b3fac8cfa27fa1c4bd","project":"openstack/keystone","branch":"master","topic":"review/990489","attention_set":{},"removed_from_attention_set":{"7973":{"account":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"last_update":"2026-06-01 11:08:22.000000000","reason":"Change was submitted"},"7414":{"account":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"last_update":"2026-06-01 11:08:22.000000000","reason":"Change was submitted"},"14250":{"account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"last_update":"2026-06-01 08:55:31.000000000","reason":"\u003cGERRIT_ACCOUNT_14250\u003e replied on the change","reason_account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"}},"27900":{"account":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"last_update":"2026-06-01 11:08:22.000000000","reason":"Change was submitted"}},"hashtags":["CVE-2026-42999"],"change_id":"I295d1ac27faad05a680bb2b3fac8cfa27fa1c4bd","subject":"Prevent RBAC policy bypass via JSON body and query filters (CVE-2026-42999)","status":"MERGED","created":"2026-05-28 15:05:16.000000000","updated":"2026-06-01 11:11:55.000000000","submitted":"2026-06-01 11:08:22.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":1,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"990489-review/990489","meta_rev_id":"0888b5984dd59b9f162af424f898dcd02c13acd9","_number":990489,"virtual_id_number":990489,"owner":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":0,"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-06-01 11:08:22.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"all":[{"value":2,"date":"2026-06-01 08:55:31.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":2,"date":"2026-05-29 12:38:58.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"all":[{"value":1,"date":"2026-06-01 08:55:31.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":0,"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"}],"reviewers":{"REVIEWER":[{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}],"CC":[{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-05-28 15:05:16.000000000","updated_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"reviewer":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"state":"REVIEWER"},{"updated":"2026-05-28 16:02:40.000000000","updated_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"reviewer":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"state":"CC"},{"updated":"2026-05-28 17:56:52.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"CC"},{"updated":"2026-05-28 17:57:02.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-05-28 19:41:49.000000000","updated_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"reviewer":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"state":"REVIEWER"},{"updated":"2026-05-28 20:07:28.000000000","updated_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"reviewer":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"state":"REVIEWER"},{"updated":"2026-05-28 20:07:28.000000000","updated_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"reviewer":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"state":"REVIEWER"},{"updated":"2026-05-29 10:00:39.000000000","updated_by":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"reviewer":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"state":"CC"}],"messages":[{"id":"7a2aea458223a2651a8ce732ccb66e7a6eed12f8","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-05-28 15:05:16.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"a18a1d05a7969ace6b6cc9cdfa8889c3cc40b735","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-05-28 16:02:40.000000000","message":"Uploaded patch set 2: New patch set was added with same tree, parent tree, and commit message as Patch Set 1.","accounts_in_message":[],"_revision_number":2},{"id":"90e0be9a10a8df245e98f82dca735272788aa81c","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-28 17:56:52.000000000","message":"Patch Set 2:\n\nBuild succeeded (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/d1fb5fbf40df48a6bbdfa6678ab30c02\n\n- openstack-tox-py311-arm64 https://zuul.opendev.org/t/openstack/build/379d6fb33a6c48cb8459e3337abd6dd0 : NODE_FAILURE Node(set) request 6e37c4f4824547a8b9c1edbfd96fc759 failed in 0s (non-voting)\n- openstack-tox-py313-arm64 https://zuul.opendev.org/t/openstack/build/c27fc31d91fd43a989aed9c6438fa9bc : NODE_FAILURE Node(set) request 17c6327e1e974458bd6245ba9df93522 failed in 0s (non-voting)\n- openstack-tox-py314-arm64 https://zuul.opendev.org/t/openstack/build/d29c6323be564216ac152125b119249f : NODE_FAILURE Node(set) request f4eceac5dc17455fa42baaa25b152eea failed in 0s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"a801da893ac6758d6e6798a21684a10620926d66","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-28 17:57:02.000000000","message":"Patch Set 2: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/2cd28d60ae7f4b41b876fe524f5060b6\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/388548d833dc49cbafdfdb059964770f : SUCCESS in 20m 46s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/f2e3ad035328405fad3392934f35d6a3 : FAILURE in 6m 10s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/748d740b408b4fb8b51dd9ac51e7fcd7 : SUCCESS in 8m 50s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/f4f38558280042dd8d354da406cf7428 : SUCCESS in 11m 47s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/184ff1fced2f472184dc7a124d918bcc : SUCCESS in 14m 36s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/fe505a5b027044e29a66d5a90dd9bfe0 : SUCCESS in 7m 28s\n- grenade https://zuul.opendev.org/t/openstack/build/62eda69ee4aa4d4a998c2f19fca3888f : SUCCESS in 36m 38s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/8d041d9067fe4ea3a0f553df0e39f50f : SUCCESS in 1h 48m 01s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/45596a63e7ec457899656074b8997406 : SUCCESS in 5m 03s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/64901ded79894376be24358c5b5d8838 : SUCCESS in 19m 53s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/cc3b18b9e65140d0b430afe406b94eb3 : SUCCESS in 29m 57s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/310d5a4192f34268b0e027f29aa40569 : FAILURE in 19m 41s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/d9b97bd9d672460d9bccbd7f309cddfa : FAILURE in 16m 16s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/c8efd01ae8cd4eac9bb4f1c1c4dad654 : SUCCESS in 17m 23s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/1369344bd21a48ab8ec8aafba5a3c703 : FAILURE in 33m 37s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/8aa80a61b29c460885bc0ee0cc75b17a : SUCCESS in 38m 27s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/52d5291e73754e53a1355b33712e5cd2 : SUCCESS in 1h 08m 51s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/cfddc4a48f044ffdae789a4e385b2379 : SUCCESS in 42m 36s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/60e3a74cabab414a9595d78f7f5aa7cf : SUCCESS in 7m 42s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"9323728aff3b4188df7058a6d5cf94332b7fccf1","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-05-28 19:41:49.000000000","message":"Uploaded patch set 3: Patch Set 2 was rebased.\n\nOutdated Votes:\n* Verified-1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":3},{"id":"de4444a9f233633752b05ce6d5e57e3d112ea3c3","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-05-28 20:07:28.000000000","message":"Patch Set 3:\n\nThis change is ready for review.","accounts_in_message":[],"_revision_number":3},{"id":"2e4b307ec495649ce5617a5ce0d699f0f65a8d10","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-05-28 21:30:17.000000000","message":"Uploaded patch set 4.","accounts_in_message":[],"_revision_number":4},{"id":"26029e471127069c372f25d301b7883d09e38312","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-05-28 21:34:29.000000000","message":"Patch Set 5: Patch Set 4 was rebased","accounts_in_message":[],"_revision_number":5},{"id":"56bed84942b086c79f5f19abfb08cee23a5211b8","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-28 23:06:01.000000000","message":"Patch Set 5: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/4741f3587bfd416bb15de92ee5eb7565\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/5314e9d45b664f1889a3ea6126c6a295 : SUCCESS in 14m 42s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/4f6a19e1431c404db50581811025b3b3 : SUCCESS in 3m 03s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/44e7a35cddef4c33b41ad89da5b9dfe1 : SUCCESS in 9m 32s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/08227812f42e4f7ea887cdd88f482a35 : SUCCESS in 11m 38s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/44065b2d7ccc4184910497b1e75bd209 : SUCCESS in 14m 43s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/6affa2ce17ca48f09085738659b1a4db : SUCCESS in 11m 40s\n- grenade https://zuul.opendev.org/t/openstack/build/319c00bd028a48fea7062aa3bb18f2eb : SUCCESS in 1h 07m 23s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/a33b50214af04aa5894d23263e4945da : SUCCESS in 1h 29m 26s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/9de6ed0b1a2b451c9b7612159a09a9ec : SUCCESS in 11m 58s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/56e1a92e91cf4ab5b8b03951fb1ffc01 : SUCCESS in 16m 20s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/25b961351b66451099364f51f4d6599f : SUCCESS in 30m 55s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/8c58010a735b4d06b809d40bac682afb : FAILURE in 20m 29s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/71bab1d5283f42de915b990206bcfa0e : FAILURE in 14m 03s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/09fe34f559e640f4a9fb0fc3e28f5677 : SUCCESS in 30m 50s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/df04f2526a7d4c6fb1e24fd8700f6eef : FAILURE in 36m 51s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/7fcf6b9c75374e358bffbe7d50dcadea : SUCCESS in 37m 12s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/3dda9f1113ba4d4dbe0c6f774e2fb315 : SUCCESS in 59m 42s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/65dc2b0e99e0404da0b0542b71334177 : SUCCESS in 44m 00s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/0b75d84aaaaf48fc8aa27eaaa4602457 : SUCCESS in 7m 05s (non-voting)","accounts_in_message":[],"_revision_number":5},{"id":"6f5e8fccfe00add23e7abf3c039cc757261cf60b","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-29 00:21:29.000000000","message":"Patch Set 5:\n\nBuild succeeded (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/65737ab5a97d40dd896039ffb1f5d908\n\n- openstack-tox-py311-arm64 https://zuul.opendev.org/t/openstack/build/c32083cda1dd4acb895b6f3b777c56d6 : SUCCESS in 23m 05s (non-voting)\n- openstack-tox-py313-arm64 https://zuul.opendev.org/t/openstack/build/01e1095a5fe2436d835a4acbf2d981c4 : SUCCESS in 21m 55s (non-voting)\n- openstack-tox-py314-arm64 https://zuul.opendev.org/t/openstack/build/a0ad252cc8034c2a854fd724ce8e98c0 : SUCCESS in 34m 22s (non-voting)","accounts_in_message":[],"_revision_number":5},{"id":"4216c63543704fe486b5e5798f930d77bd203bf9","tag":"autogenerated:gerrit:setHashtag","author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"date":"2026-05-29 06:39:15.000000000","message":"Hashtag added: CVE-2026-42999","accounts_in_message":[],"_revision_number":5},{"id":"b03548f385ec1102a98c50fcee9cdda50bdeaa31","author":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"date":"2026-05-29 10:00:39.000000000","message":"Patch Set 5:\n\n(1 comment)","accounts_in_message":[],"_revision_number":5},{"id":"827174158caf2ee2c0ceddc8a4b966a5bb51c2dd","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-29 11:51:44.000000000","message":"Patch Set 5: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/2344040510e541b0995ab36aa43a11fa\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/6601964c99e24c37a3e1de410c5f154c : SUCCESS in 20m 30s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/5f6264c68df54581b8d1c2deccffd025 : SUCCESS in 7m 31s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/b1fec095fe78481f8e9b0e4b515a9bf1 : SUCCESS in 11m 52s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/205c63bc0a7a4440bd5723a813ee52c6 : SUCCESS in 10m 47s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/fbe59182b52140208b8a98eb95110bc3 : SUCCESS in 15m 51s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/d65907cc5a6e4e5cab68bae05b52064f : SUCCESS in 14m 14s\n- grenade https://zuul.opendev.org/t/openstack/build/2f53b202a1d34201827957f12b8f8c79 : SUCCESS in 1h 04m 00s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/f7fa3fcec47849b5b423654a563cd7fd : SUCCESS in 1h 47m 39s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/1ce483df57fc499e9f994b36db27da57 : SUCCESS in 11m 56s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/9aeb31a6c28f41c4b440781f90e842da : SUCCESS in 19m 49s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/a6ec737300a444109b350cde85316320 : SUCCESS in 34m 28s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/a12406def986411a9482af6115ac0c2f : FAILURE in 13m 13s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/d55c102cb8be430a817177f784c3c97b : FAILURE in 27m 05s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/afb7b4987e234e12b7111c5e11bacf22 : SUCCESS in 30m 20s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/4a1686909de04d74a3c518adb198d6e9 : SUCCESS in 31m 43s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/ad32d4b3082044619d8b59d16fef8a5e : SUCCESS in 36m 49s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/837990842825402b84d26119bedb9c3d : SUCCESS in 1h 07m 49s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/854df40dedd04c12844ba5a224642a9f : SUCCESS in 47m 36s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/869e2f4931144edeadd76f5985a2cbb0 : SUCCESS in 7m 49s (non-voting)","accounts_in_message":[],"_revision_number":5},{"id":"08d5d1ae1dd573e396b7b72bc5dfbdd3587c417e","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-05-29 12:38:58.000000000","message":"Patch Set 5: Code-Review+2","accounts_in_message":[],"_revision_number":5},{"id":"b5a0e9e4a5adfa34d29d386895987ed813fd05e2","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-29 14:30:46.000000000","message":"Patch Set 5:\n\nBuild succeeded (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/567d93f897f44584811c36873fa8ba67\n\n- openstack-tox-py311-arm64 https://zuul.opendev.org/t/openstack/build/9c839f9f92b340fbaeb969fcb25c113f : SUCCESS in 20m 56s (non-voting)\n- openstack-tox-py313-arm64 https://zuul.opendev.org/t/openstack/build/63f7e7015b4e4a79aac76190afeebfec : SUCCESS in 21m 40s (non-voting)\n- openstack-tox-py314-arm64 https://zuul.opendev.org/t/openstack/build/08c0d0eefc7b4b06a6329063065cb45f : SUCCESS in 22m 05s (non-voting)","accounts_in_message":[],"_revision_number":5},{"id":"207307618e4be6c9952c3cab3cdbaf4d8f48c036","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-06-01 08:55:31.000000000","message":"Patch Set 5: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":5},{"id":"90b71128e1d5b2f1a1bcee7bce5c23c7721f65dd","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-01 08:56:17.000000000","message":"Patch Set 5: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":5},{"id":"db6fa8739d7c08ee3bb2b1677cec1042540c01e0","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-01 11:08:22.000000000","message":"Patch Set 5: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/f6c109d59fb44c5198879cae26fd143d\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/ef9b855079484529aa9cbba1f3bab21a : SUCCESS in 6m 05s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/95dcd2d28937423f9fcc3628b8881ec6 : SUCCESS in 9m 39s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/391500180e804039a6bc2d44adb1eb7f : SUCCESS in 11m 30s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/fe0cfdcf53064409b0edcd79ec5a12f4 : SUCCESS in 7m 52s\n- grenade https://zuul.opendev.org/t/openstack/build/02ca9dc4b27447bba69b2f4c6975c780 : SUCCESS in 51m 06s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/5a3930e9309a4716bd97599358a1e091 : SUCCESS in 1h 05m 30s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/e047932543a542bca39a4278450c2d77 : SUCCESS in 6m 39s\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/1d5a6a7150fd448abce426d0a7ac39c8 : SUCCESS in 24m 55s\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/b5f3d6ca608e45d1a7faace1bdf55bee : SUCCESS in 34m 54s\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/66f5dbfa386c4110a300826c629d0cc6 : SUCCESS in 53m 46s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/490642f334fc43638e2ab1a1c77b79ef : SUCCESS in 24m 14s","accounts_in_message":[],"_revision_number":5},{"id":"2e8ce3bd171e393e8fee22bc9ded65885384ee1d","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-01 11:08:22.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":5},{"id":"0888b5984dd59b9f162af424f898dcd02c13acd9","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-01 11:11:55.000000000","message":"Patch Set 5:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/b9022743b108426786c3c2d82c8fb7d2\n\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/9c87d43446d5493aac21b7202a46f5ad : SUCCESS in 55s\n- promote-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/773eb634d8b8455aa8bce349baa9a72f : SUCCESS in 44s","accounts_in_message":[],"_revision_number":5}],"current_revision_number":5,"current_revision":"a9d6832ae70cbd06dadbbaeb9d4b18a7553fca3b","revisions":{"9197b262df348ebc337c269fbdddaed24f5cb7e5":{"kind":"REWORK","_number":1,"created":"2026-05-28 15:05:16.000000000","uploader":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"ref":"refs/changes/89/990489/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/89/990489/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/89/990489/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/89/990489/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/89/990489/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/89/990489/1"}}},"commit":{"parents":[{"commit":"d1510514a3b58af8df2bd9bb381cf0863f40ce3a","subject":"Preserve expires_at when rescoping federated tokens (CVE-2026-44394)","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/d1510514a3b58af8df2bd9bb381cf0863f40ce3a"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-05-12 07:10:20.000000000","tz":120},"committer":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2026-05-22 08:08:11.000000000","tz":120},"subject":"Prevent RBAC policy bypass via JSON body and query filters (CVE-2026-42999)","message":"Prevent RBAC policy bypass via JSON body and query filters (CVE-2026-42999)\n\nThe RBAC enforcer unconditionally merged the raw JSON request body into\nthe policy enforcement dictionary after trusted target data had been set\nfrom the database. An attacker could include a \"target\" key in the JSON\nbody to overwrite database-sourced RBAC target attributes, causing all\n%(target.*)s policy substitutions to evaluate against attacker-controlled\nvalues. This affected 88 endpoint/method combinations across all Keystone\nAPI resources.\n\nThe fix namespaces user-controlled JSON body data under a \"request_body\"\nkey in the policy dict, making it structurally impossible for request body\nfields to collide with internal keys like \"target\" or view_args.\n\nThe only in-tree policy rule that depended on the old JSON body merge\nbehavior was identity:create_trust, which referenced\n%(trust.trustor_user_id)s from the request body at the top level of the\npolicy dict. This is updated to use target_attr and the\n%(target.trust.trustor_user_id)s substitution, consistent with all other\ntrust policy rules.\n\nAdditionally, query-string filter values had the same structural issue:\n_extract_filter_values() results were merged at the top level, meaning a\nfilter key matching a view_arg key (e.g. user_id on\n/v3/users/{user_id}/... endpoints using ADMIN_OR_SYSTEM_READER_OR_OWNER)\ncould be overwritten by an attacker-controlled ?user_id\u003d query param,\nbypassing ownership checks. Filter values are now namespaced under\n\"filter_attr\". No in-tree policy rule references filter values via %(key)s\nsubstitutions, so this is backwards-compatible for upstream deployments.\n\nCloses-Bug: #2148398\nAssisted-by: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\nCo-authored-by: Boris Bobrov \u003cb.bobrov@sap.com\u003e\nCo-authored-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\nChange-Id: I295d1ac27faad05a680bb2b3fac8cfa27fa1c4bd\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/9197b262df348ebc337c269fbdddaed24f5cb7e5"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/9197b262df348ebc337c269fbdddaed24f5cb7e5"}]},"branch":"refs/heads/master"},"3f3497e5b8759f5fd10a450d526ac252488921ac":{"kind":"NO_CHANGE","_number":2,"created":"2026-05-28 16:02:40.000000000","uploader":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"ref":"refs/changes/89/990489/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/89/990489/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/89/990489/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/89/990489/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/89/990489/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/89/990489/2"}}},"commit":{"parents":[{"commit":"2a411b529492830b4ddc9126fb90485863d58784","subject":"Preserve expires_at when rescoping federated tokens (CVE-2026-44394)","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/2a411b529492830b4ddc9126fb90485863d58784"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-05-12 07:10:20.000000000","tz":120},"committer":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2026-05-28 16:02:30.000000000","tz":120},"subject":"Prevent RBAC policy bypass via JSON body and query filters (CVE-2026-42999)","message":"Prevent RBAC policy bypass via JSON body and query filters (CVE-2026-42999)\n\nThe RBAC enforcer unconditionally merged the raw JSON request body into\nthe policy enforcement dictionary after trusted target data had been set\nfrom the database. An attacker could include a \"target\" key in the JSON\nbody to overwrite database-sourced RBAC target attributes, causing all\n%(target.*)s policy substitutions to evaluate against attacker-controlled\nvalues. This affected 88 endpoint/method combinations across all Keystone\nAPI resources.\n\nThe fix namespaces user-controlled JSON body data under a \"request_body\"\nkey in the policy dict, making it structurally impossible for request body\nfields to collide with internal keys like \"target\" or view_args.\n\nThe only in-tree policy rule that depended on the old JSON body merge\nbehavior was identity:create_trust, which referenced\n%(trust.trustor_user_id)s from the request body at the top level of the\npolicy dict. This is updated to use target_attr and the\n%(target.trust.trustor_user_id)s substitution, consistent with all other\ntrust policy rules.\n\nAdditionally, query-string filter values had the same structural issue:\n_extract_filter_values() results were merged at the top level, meaning a\nfilter key matching a view_arg key (e.g. user_id on\n/v3/users/{user_id}/... endpoints using ADMIN_OR_SYSTEM_READER_OR_OWNER)\ncould be overwritten by an attacker-controlled ?user_id\u003d query param,\nbypassing ownership checks. Filter values are now namespaced under\n\"filter_attr\". No in-tree policy rule references filter values via %(key)s\nsubstitutions, so this is backwards-compatible for upstream deployments.\n\nCloses-Bug: #2148398\nAssisted-by: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\nCo-authored-by: Boris Bobrov \u003cb.bobrov@sap.com\u003e\nCo-authored-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\nChange-Id: I295d1ac27faad05a680bb2b3fac8cfa27fa1c4bd\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/3f3497e5b8759f5fd10a450d526ac252488921ac"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/3f3497e5b8759f5fd10a450d526ac252488921ac"}]},"branch":"refs/heads/master"},"2110ded9e5105f3819b983e3ac8fccee1d6d2b1c":{"kind":"TRIVIAL_REBASE","_number":3,"created":"2026-05-28 19:41:49.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/89/990489/3","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/89/990489/3","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/89/990489/3 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/89/990489/3 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/89/990489/3 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/89/990489/3"}}},"commit":{"parents":[{"commit":"aeb3e775d31ce33401fa9d3857c4e411848569ce","subject":"Preserve expires_at when rescoping federated tokens (CVE-2026-44394)","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/aeb3e775d31ce33401fa9d3857c4e411848569ce"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-05-12 07:10:20.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-05-28 19:40:18.000000000","tz":120},"subject":"Prevent RBAC policy bypass via JSON body and query filters (CVE-2026-42999)","message":"Prevent RBAC policy bypass via JSON body and query filters (CVE-2026-42999)\n\nThe RBAC enforcer unconditionally merged the raw JSON request body into\nthe policy enforcement dictionary after trusted target data had been set\nfrom the database. An attacker could include a \"target\" key in the JSON\nbody to overwrite database-sourced RBAC target attributes, causing all\n%(target.*)s policy substitutions to evaluate against attacker-controlled\nvalues. This affected 88 endpoint/method combinations across all Keystone\nAPI resources.\n\nThe fix namespaces user-controlled JSON body data under a \"request_body\"\nkey in the policy dict, making it structurally impossible for request body\nfields to collide with internal keys like \"target\" or view_args.\n\nThe only in-tree policy rule that depended on the old JSON body merge\nbehavior was identity:create_trust, which referenced\n%(trust.trustor_user_id)s from the request body at the top level of the\npolicy dict. This is updated to use target_attr and the\n%(target.trust.trustor_user_id)s substitution, consistent with all other\ntrust policy rules.\n\nAdditionally, query-string filter values had the same structural issue:\n_extract_filter_values() results were merged at the top level, meaning a\nfilter key matching a view_arg key (e.g. user_id on\n/v3/users/{user_id}/... endpoints using ADMIN_OR_SYSTEM_READER_OR_OWNER)\ncould be overwritten by an attacker-controlled ?user_id\u003d query param,\nbypassing ownership checks. Filter values are now namespaced under\n\"filter_attr\". No in-tree policy rule references filter values via %(key)s\nsubstitutions, so this is backwards-compatible for upstream deployments.\n\nCloses-Bug: #2148398\nAssisted-by: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\nCo-authored-by: Boris Bobrov \u003cb.bobrov@sap.com\u003e\nCo-authored-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\nChange-Id: I295d1ac27faad05a680bb2b3fac8cfa27fa1c4bd\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/2110ded9e5105f3819b983e3ac8fccee1d6d2b1c"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/2110ded9e5105f3819b983e3ac8fccee1d6d2b1c"}]},"branch":"refs/heads/master"},"a2b62ee8cff57bdecf26717e7e1108b3faf581ab":{"kind":"REWORK","_number":4,"created":"2026-05-28 21:30:17.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/89/990489/4","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/89/990489/4","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/89/990489/4 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/89/990489/4 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/89/990489/4 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/89/990489/4"}}},"commit":{"parents":[{"commit":"aeb3e775d31ce33401fa9d3857c4e411848569ce","subject":"Preserve expires_at when rescoping federated tokens (CVE-2026-44394)","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/aeb3e775d31ce33401fa9d3857c4e411848569ce"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-05-12 07:10:20.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-05-28 21:29:11.000000000","tz":120},"subject":"Prevent RBAC policy bypass via JSON body and query filters (CVE-2026-42999)","message":"Prevent RBAC policy bypass via JSON body and query filters (CVE-2026-42999)\n\nThe RBAC enforcer unconditionally merged the raw JSON request body into\nthe policy enforcement dictionary after trusted target data had been set\nfrom the database. An attacker could include a \"target\" key in the JSON\nbody to overwrite database-sourced RBAC target attributes, causing all\n%(target.*)s policy substitutions to evaluate against attacker-controlled\nvalues. This affected 88 endpoint/method combinations across all Keystone\nAPI resources.\n\nThe fix namespaces user-controlled JSON body data under a \"request_body\"\nkey in the policy dict, making it structurally impossible for request body\nfields to collide with internal keys like \"target\" or view_args.\n\nThe only in-tree policy rule that depended on the old JSON body merge\nbehavior was identity:create_trust, which referenced\n%(trust.trustor_user_id)s from the request body at the top level of the\npolicy dict. This is updated to use target_attr and the\n%(target.trust.trustor_user_id)s substitution, consistent with all other\ntrust policy rules.\n\nAdditionally, query-string filter values had the same structural issue:\n_extract_filter_values() results were merged at the top level, meaning a\nfilter key matching a view_arg key (e.g. user_id on\n/v3/users/{user_id}/... endpoints using ADMIN_OR_SYSTEM_READER_OR_OWNER)\ncould be overwritten by an attacker-controlled ?user_id\u003d query param,\nbypassing ownership checks. Filter values are now namespaced under\n\"filter_attr\". No in-tree policy rule references filter values via %(key)s\nsubstitutions, so this is backwards-compatible for upstream deployments.\n\nCloses-Bug: #2148398\nAssisted-by: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\nCo-authored-by: Boris Bobrov \u003cb.bobrov@sap.com\u003e\nCo-authored-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\nChange-Id: I295d1ac27faad05a680bb2b3fac8cfa27fa1c4bd\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/a2b62ee8cff57bdecf26717e7e1108b3faf581ab"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/a2b62ee8cff57bdecf26717e7e1108b3faf581ab"}]},"branch":"refs/heads/master"},"a9d6832ae70cbd06dadbbaeb9d4b18a7553fca3b":{"kind":"TRIVIAL_REBASE","_number":5,"created":"2026-05-28 21:34:29.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/89/990489/5","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/89/990489/5","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/89/990489/5 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/89/990489/5 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/89/990489/5 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/89/990489/5"}}},"commit":{"parents":[{"commit":"f94605302a742598478328426240b1e2b6a0d6e4","subject":"Preserve expires_at when rescoping federated tokens (CVE-2026-44394)","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/f94605302a742598478328426240b1e2b6a0d6e4"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-05-12 07:10:20.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-05-28 21:34:29.000000000","tz":0},"subject":"Prevent RBAC policy bypass via JSON body and query filters (CVE-2026-42999)","message":"Prevent RBAC policy bypass via JSON body and query filters (CVE-2026-42999)\n\nThe RBAC enforcer unconditionally merged the raw JSON request body into\nthe policy enforcement dictionary after trusted target data had been set\nfrom the database. An attacker could include a \"target\" key in the JSON\nbody to overwrite database-sourced RBAC target attributes, causing all\n%(target.*)s policy substitutions to evaluate against attacker-controlled\nvalues. This affected 88 endpoint/method combinations across all Keystone\nAPI resources.\n\nThe fix namespaces user-controlled JSON body data under a \"request_body\"\nkey in the policy dict, making it structurally impossible for request body\nfields to collide with internal keys like \"target\" or view_args.\n\nThe only in-tree policy rule that depended on the old JSON body merge\nbehavior was identity:create_trust, which referenced\n%(trust.trustor_user_id)s from the request body at the top level of the\npolicy dict. This is updated to use target_attr and the\n%(target.trust.trustor_user_id)s substitution, consistent with all other\ntrust policy rules.\n\nAdditionally, query-string filter values had the same structural issue:\n_extract_filter_values() results were merged at the top level, meaning a\nfilter key matching a view_arg key (e.g. user_id on\n/v3/users/{user_id}/... endpoints using ADMIN_OR_SYSTEM_READER_OR_OWNER)\ncould be overwritten by an attacker-controlled ?user_id\u003d query param,\nbypassing ownership checks. Filter values are now namespaced under\n\"filter_attr\". No in-tree policy rule references filter values via %(key)s\nsubstitutions, so this is backwards-compatible for upstream deployments.\n\nCloses-Bug: #2148398\nAssisted-by: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\nCo-authored-by: Boris Bobrov \u003cb.bobrov@sap.com\u003e\nCo-authored-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\nChange-Id: I295d1ac27faad05a680bb2b3fac8cfa27fa1c4bd\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/a9d6832ae70cbd06dadbbaeb9d4b18a7553fca3b"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/a9d6832ae70cbd06dadbbaeb9d4b18a7553fca3b"}]},"branch":"refs/heads/master","description":"Rebase","conflicts":{"ours":"a2b62ee8cff57bdecf26717e7e1108b3faf581ab","theirs":"f94605302a742598478328426240b1e2b6a0d6e4","contains_conflicts":false}}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}