)]}'
{"id":"openstack%2Fkeystone~990491","triplet_id":"openstack%2Fkeystone~stable%2F2026.1~I2fe6089886eebf3775930451b87771e40b5e179e","project":"openstack/keystone","branch":"stable/2026.1","attention_set":{},"removed_from_attention_set":{"14250":{"account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"last_update":"2026-05-29 15:29:18.000000000","reason":"\u003cGERRIT_ACCOUNT_14250\u003e replied on the change","reason_account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"}},"27900":{"account":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"last_update":"2026-06-01 12:23:50.000000000","reason":"Change was submitted"}},"hashtags":["CVE-2026-42998"],"change_id":"I2fe6089886eebf3775930451b87771e40b5e179e","subject":"Fix user impersonation through application credentials (CVE-2026-42998)","status":"MERGED","created":"2026-05-28 15:05:47.000000000","updated":"2026-06-01 12:25:45.000000000","submitted":"2026-06-01 12:23:50.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":1,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"990491","meta_rev_id":"e162b9b6cb862ced2865fa8db07ffe9febc5eb92","_number":990491,"virtual_id_number":990491,"owner":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-06-01 12:23:50.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"all":[{"value":2,"date":"2026-06-01 08:56:18.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"all":[{"value":1,"date":"2026-06-01 08:56:18.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-05-28 15:05:47.000000000","updated_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"reviewer":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"state":"REVIEWER"},{"updated":"2026-05-28 16:16:01.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"}],"messages":[{"id":"0c834c697331a8847ee49f7a670a1c04a27c4658","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-05-28 15:05:47.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"6e29e343b97543466a0265fb8e93ef4bf0faf5b9","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-28 16:16:01.000000000","message":"Patch Set 1: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/6783a24da7c249ccba876057d1d746ba\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/ae251905baec400b8ee5cb3e625e8d42 : SUCCESS in 17m 29s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/57e18dc0bb4e4096bd503d4b60521a2e : FAILURE in 3m 31s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/871b5f6692de477b8799905cc1b802eb : SUCCESS in 12m 20s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/0c6e5dd3249543458dff457a093c7813 : SUCCESS in 13m 11s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/90dfd2627f054c13a6fbc371e2739bbc : SUCCESS in 15m 15s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/0e9d7953aaa0467d8d5d3eb1614f1342 : SUCCESS in 8m 04s\n- grenade https://zuul.opendev.org/t/openstack/build/b61cb2fdcb7f49a0b09fa24c081b43bf : SUCCESS in 1h 03m 51s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/e5fb1e1098a4471e88159c602edabbee : SUCCESS in 57m 41s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/2d760e9a7817434fa1a92b55fbe7e99c : SUCCESS in 13m 43s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/23d4f66f85fe411a82328f6f743f3d98 : SUCCESS in 15m 49s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/6d7b9b646c664dfb8c36178c0285e70b : SUCCESS in 23m 13s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/edcb131996694443a4c8ab49076c7836 : FAILURE in 12m 31s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/f91c0cd21dad450ba7788f476e8b5175 : FAILURE in 22m 04s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/2775981f3d3e4436abf9855af782aa22 : SUCCESS in 27m 31s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/31419195e48c42a9beb903a3534e21ca : FAILURE in 28m 37s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/1b8704f7bfbf46c7a237288887e48ad9 : SUCCESS in 23m 38s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/9e0879613f18464cb8a20bc68249536a : SUCCESS in 50m 50s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/bb3fb01845ea42a19d4a94217c3c2a83 : SUCCESS in 33m 32s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/9f3beed757594a6fb5a3ea0186ddd216 : SUCCESS in 5m 46s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"1176d310b659c9889c599bb5a6ef0502bafd6b35","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-05-28 21:57:46.000000000","message":"Uploaded patch set 2: Patch Set 1 was rebased.\n\nOutdated Votes:\n* Verified-1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":2},{"id":"375bb5524f5314af37c3bd91ca0a726612cf716d","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-28 23:48:14.000000000","message":"Patch Set 2: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/4613af0dce6f40e6b960e5ffad038b73\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/57b330e2b8fe4aa88f06fb5fb584ea89 : SUCCESS in 20m 59s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/5c05de5326054470a87294a141aade16 : SUCCESS in 5m 57s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/d35dfb0bfe8a46d9bee4d0e7a5af50df : SUCCESS in 12m 01s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/443ca362d39f44f9beb1d37e6bb4d19a : SUCCESS in 12m 24s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/a37902608cdd4851b6c8f61eb3c81754 : SUCCESS in 9m 31s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/20462956380741b5a9d54c1f8c869594 : SUCCESS in 14m 21s\n- grenade https://zuul.opendev.org/t/openstack/build/cddea385dab7460a8344683f037d0e7e : SUCCESS in 1h 03m 31s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/c58cb4f78a704a6389d1f603a8e2aafc : SUCCESS in 1h 45m 17s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/3922e2de38d84912906eee6157c1fea1 : SUCCESS in 5m 07s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/7161ae7e8ef7460e856e4a4b8268e396 : SUCCESS in 9m 39s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/401583fec9c843649d5da82c9e921916 : SUCCESS in 16m 15s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/bca0ca9af29a455c9de426e39f569e94 : FAILURE in 10m 39s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/5bcc201312c84c7797e32ac712d36795 : FAILURE in 18m 53s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/18d298ae920f46659ae4427927198418 : SUCCESS in 29m 02s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/b85e5ebf4e5740838df29df5b0cf3714 : FAILURE in 32m 29s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/07abf3bb5a784e52b33c96efb36f7577 : SUCCESS in 36m 25s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/d882be63b3c848a7b31150bde737e6e0 : SUCCESS in 1h 03m 26s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/5cef42b972fa42a6b0c1fc11bb86df24 : SUCCESS in 21m 17s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/2e1a1f085b3148a682aae44b40b0cf95 : SUCCESS in 7m 55s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"2904a523d56d87a30033b684d9e4d0c7ac23979d","tag":"autogenerated:gerrit:setHashtag","author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"date":"2026-05-29 06:39:10.000000000","message":"Hashtag added: CVE-2026-42998","accounts_in_message":[],"_revision_number":2},{"id":"0fcc74cea27100635173c0a4ef483cf25e5977ee","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-05-29 15:29:18.000000000","message":"Patch Set 2:\n\n(1 comment)","accounts_in_message":[],"_revision_number":2},{"id":"c42bb6d6ad5656c4aea570492e999006a95158bc","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-29 17:30:01.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/ec9725efd8534c138805feb93d8b0e92\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/ed31e2514ec64e16a9e2e51c10dcb6da : SUCCESS in 18m 20s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/31ba8ee45d024fc8984201634e910a67 : SUCCESS in 7m 02s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/e80a0c70956a4449a4a2bafa458d3e62 : SUCCESS in 9m 59s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/843aad98c7ee4941837236ff67098249 : SUCCESS in 10m 51s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/9f077b5838bc412897f4a73859b484fe : SUCCESS in 15m 12s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/e4a0b82acf984d3594fc44f28788ab54 : SUCCESS in 14m 22s\n- grenade https://zuul.opendev.org/t/openstack/build/56ec29a34d234106b5ce3adc1911f7bb : SUCCESS in 34m 00s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/9e3d1318dd3c439dbb536e170e08b977 : SUCCESS in 1h 57m 31s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/7ac716d0d6c64a3aabe7c6502251c9e9 : SUCCESS in 11m 01s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/f122ef6a564a4bb4b26b0a1cb51a0102 : SUCCESS in 19m 22s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/36cec07ac7754a21acf80d6559048e1b : SUCCESS in 31m 14s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/8d955cb5edcb413eb8947bf8b94dc7c6 : FAILURE in 16m 16s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/a05181607ff94545a195629867ee642d : FAILURE in 28m 20s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/64e78b40b209481ca99dfe3b5c761fc2 : SUCCESS in 19m 08s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/c5d138e5b9454cba92086bf135a81dcb : SUCCESS in 14m 54s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/cf433c310ae34008b533d7460e049390 : SUCCESS in 33m 47s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/a1895087277b46f5aa89c89ca86be9f5 : SUCCESS in 1h 03m 26s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/932aa0c662c04d87aaafcc8e335f277f : SUCCESS in 38m 47s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/e85f1938b3c447d78cb0de7a23772c09 : SUCCESS in 7m 14s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"b88ae25d99683f69eb365056ef641fdcd09e6401","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-06-01 08:56:18.000000000","message":"Patch Set 2: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":2},{"id":"84958dc2f2f799cbe28085062c6ffef1671ed759","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-01 08:57:03.000000000","message":"Patch Set 2: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":2},{"id":"7243bb7683e8b152d0284236c3a595090851f348","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-01 12:23:50.000000000","message":"Patch Set 2: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/abba06b6b6fe425191a40a4579a77909\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/07c44e0751624ab1be8476bfb17aa6c0 : SUCCESS in 5m 21s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/0245f238cbfd46a2acfed931ae250e7b : SUCCESS in 9m 51s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/c00411d7aaca4de4a922c4647196be4a : SUCCESS in 11m 06s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/28053ccf3c7d4d54b2076b45f851e414 : SUCCESS in 12m 54s\n- grenade https://zuul.opendev.org/t/openstack/build/730a1bce4aae4ff7b0eb377798be5b02 : SUCCESS in 35m 27s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/d1fdcf899cb14241be9296d8fc1165f8 : SUCCESS in 55m 16s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/35b4d5d25380425b93f097b7bed109f2 : SUCCESS in 9m 07s\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/daa32e3b3b7b4749a5d6d4fb89b1d78c : SUCCESS in 14m 21s\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/7b14c962352a48068497b78e08df8dda : SUCCESS in 21m 09s\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/7b49a6c0fe374b628037ba6c2cd6c627 : SUCCESS in 1h 08m 41s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/c5fc0225ae3d44b0bbf7b456e4ca44eb : SUCCESS in 29m 52s","accounts_in_message":[],"_revision_number":2},{"id":"cd5a6d69b7019625a51a30f7499cee113078543a","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-01 12:23:50.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":2},{"id":"e162b9b6cb862ced2865fa8db07ffe9febc5eb92","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-01 12:25:45.000000000","message":"Patch Set 2:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/77d1f152f1144f4e86d898993c9de945\n\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/200fe61f93ac44c48c210586116b2408 : SUCCESS in 1m 31s","accounts_in_message":[],"_revision_number":2}],"current_revision_number":2,"current_revision":"8c0e2c7a017e252cc5d422a692b8d52cbbc9a622","revisions":{"6890d28bd74cd01ff310fd1a95901d43aa16ae03":{"kind":"REWORK","_number":1,"created":"2026-05-28 15:05:47.000000000","uploader":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"ref":"refs/changes/91/990491/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/91/990491/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/91/990491/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/91/990491/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/91/990491/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/91/990491/1"}}},"commit":{"parents":[{"commit":"7459a4cc5627fa0c554d7a5b1c106ee4367fb477","subject":"Enforce delegation project boundary for delegated tokens","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/7459a4cc5627fa0c554d7a5b1c106ee4367fb477"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-05-12 07:22:34.000000000","tz":120},"committer":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2026-05-22 08:13:20.000000000","tz":120},"subject":"Fix user impersonation through application credentials (CVE-2026-42998)","message":"Fix user impersonation through application credentials (CVE-2026-42998)\n\nWhen authenticating by application credential ID, the caller can supply a\n\u0027user\u0027 field in the payload. AppCredInfo conditionally set the user from\nthe credential owner only when no user field was present. If present,\nBaseUserInfo resolved the caller-supplied user and attributed the resulting\ntoken to that user instead of the credential owner.\n\nFix: always set auth_payload[\u0027user\u0027] from the credential\u0027s stored user_id,\nignoring any caller-supplied value.\n\nCloses-Bug: #2148477\nAssisted-by: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\nCo-authored-by: Boris Bobrov \u003cb.bobrov@sap.com\u003e\nChange-Id: I2fe6089886eebf3775930451b87771e40b5e179e\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\nSigned-off-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\n(cherry picked from commit 6cd25fecdab8b9261e916ee10f3dba5aeb0c1984)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/6890d28bd74cd01ff310fd1a95901d43aa16ae03"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/6890d28bd74cd01ff310fd1a95901d43aa16ae03"}]},"branch":"refs/heads/stable/2026.1"},"8c0e2c7a017e252cc5d422a692b8d52cbbc9a622":{"kind":"TRIVIAL_REBASE","_number":2,"created":"2026-05-28 21:57:46.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/91/990491/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/91/990491/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/91/990491/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/91/990491/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/91/990491/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/91/990491/2"}}},"commit":{"parents":[{"commit":"96fae039132da921a37d86d6a5a7b4e67d32d6f7","subject":"Enforce delegation project boundary for delegated tokens","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/96fae039132da921a37d86d6a5a7b4e67d32d6f7"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-05-12 07:22:34.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-05-28 21:56:50.000000000","tz":120},"subject":"Fix user impersonation through application credentials (CVE-2026-42998)","message":"Fix user impersonation through application credentials (CVE-2026-42998)\n\nWhen authenticating by application credential ID, the caller can supply a\n\u0027user\u0027 field in the payload. AppCredInfo conditionally set the user from\nthe credential owner only when no user field was present. If present,\nBaseUserInfo resolved the caller-supplied user and attributed the resulting\ntoken to that user instead of the credential owner.\n\nFix: always set auth_payload[\u0027user\u0027] from the credential\u0027s stored user_id,\nignoring any caller-supplied value.\n\nCloses-Bug: #2148477\nAssisted-by: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\nCo-authored-by: Boris Bobrov \u003cb.bobrov@sap.com\u003e\nChange-Id: I2fe6089886eebf3775930451b87771e40b5e179e\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\nSigned-off-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\n(cherry picked from commit 6cd25fecdab8b9261e916ee10f3dba5aeb0c1984)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/8c0e2c7a017e252cc5d422a692b8d52cbbc9a622"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/8c0e2c7a017e252cc5d422a692b8d52cbbc9a622"}]},"branch":"refs/heads/stable/2026.1"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}