)]}'
{"id":"openstack%2Fkeystone~990492","triplet_id":"openstack%2Fkeystone~stable%2F2026.1~I750156df18a1d6293ce99c42eb524575fcf16ea3","project":"openstack/keystone","branch":"stable/2026.1","attention_set":{},"removed_from_attention_set":{"14250":{"account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"last_update":"2026-05-29 15:29:23.000000000","reason":"\u003cGERRIT_ACCOUNT_14250\u003e replied on the change","reason_account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"}},"27900":{"account":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"last_update":"2026-06-01 12:37:40.000000000","reason":"Change was submitted"}},"hashtags":["CVE-2026-43000"],"change_id":"I750156df18a1d6293ce99c42eb524575fcf16ea3","subject":"Forbid trust operations using application credentials (CVE-2026-43000)","status":"MERGED","created":"2026-05-28 15:05:47.000000000","updated":"2026-06-01 12:39:12.000000000","submitted":"2026-06-01 12:37:40.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":1,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"990492","meta_rev_id":"45036f34f52082fab8d193fb8d55d8f0278d4184","_number":990492,"virtual_id_number":990492,"owner":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-06-01 12:37:40.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"all":[{"value":2,"date":"2026-06-01 08:56:23.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"all":[{"value":1,"date":"2026-06-01 08:56:23.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-05-28 15:05:47.000000000","updated_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"reviewer":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"state":"REVIEWER"},{"updated":"2026-05-28 16:21:46.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"}],"messages":[{"id":"c7e1ec2d2170606c9745bccb6778509204224264","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-05-28 15:05:47.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"ef5a0d42fa86c9d34296bf72fc01aa7adb64e227","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-28 16:21:46.000000000","message":"Patch Set 1: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/6debbbf154d7415ca84854c84da9cec9\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/0fe94ea98fa946fbb7df927f72f4b836 : SUCCESS in 18m 09s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/0c6345ee5cfb4ef999cf80abb9a783ae : FAILURE in 5m 50s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/46c300a2f1604eaf97260ce9385e8854 : SUCCESS in 17m 13s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/1482e64b1e8a4384a468488a0be401c6 : SUCCESS in 7m 23s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/8b112b4d739f40d2b3c03012e174f7b9 : SUCCESS in 16m 52s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/63856456590343bd8d92bbb5416c570b : SUCCESS in 15m 58s\n- grenade https://zuul.opendev.org/t/openstack/build/c7f90fabc70a4d5e8f005de1a243442f : SUCCESS in 1h 01m 20s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/6e271b2abf2a498686eda4d197fa7fb3 : SUCCESS in 1h 04m 38s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/4135f625c1bf444393c2114a133e5b6c : SUCCESS in 12m 52s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/31bef4f5f52a4a80803c0659c699cefa : SUCCESS in 12m 52s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/80921f969a3341b0b6cbc2457074180f : SUCCESS in 29m 41s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/79a1317f0933469c880f4415a536bc70 : FAILURE in 13m 25s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/09746b6b457f42e29156744a03333fe4 : FAILURE in 28m 04s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/08aeafdf40f343b3a7d988ae461d9b22 : SUCCESS in 28m 56s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/93cb7da5df304e5ba7561d33df84dce9 : FAILURE in 22m 52s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/0664ca6cfd5c47cf86b42f00c596c1f5 : SUCCESS in 23m 43s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/eb4b7317895c462cb3fb1e5e450ffb4b : SUCCESS in 1h 03m 14s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/24a535ba2fa4464aa0edaa01dd28fb0f : SUCCESS in 19m 25s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/72383e967d5142308b123006962b3ced : SUCCESS in 8m 36s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"1e08d5f7744b53a35d288c510f9e160ddb781587","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-05-28 21:57:49.000000000","message":"Uploaded patch set 2: Patch Set 1 was rebased.\n\nOutdated Votes:\n* Verified-1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":2},{"id":"c37f380401464dc63d441607c7d8923951937952","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-29 00:02:15.000000000","message":"Patch Set 2: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/e96313477b09472c8411f94b5cc6362f\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/bb5c2106465d4c178bcce486a28fa56f : SUCCESS in 19m 09s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/fe222472ba8143e3a4a7cdc7cb6d2d0c : SUCCESS in 3m 42s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/09cb09b65150476fb5c2af5b06ef3e72 : SUCCESS in 13m 04s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/3554cf4c8061481487737e5401b5e16a : SUCCESS in 8m 20s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/f6c540eb97224df68bc080246b1fce8a : SUCCESS in 17m 52s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/1a8d8bb0d8b140dd82637137ba149ed1 : SUCCESS in 9m 08s\n- grenade https://zuul.opendev.org/t/openstack/build/6036eff19ed947328934c3d60cabba53 : SUCCESS in 1h 03m 20s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/fb69b95414764c2ca7fbc1981c489fbb : SUCCESS in 1h 57m 47s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/aabd133744ed499ba56e6de21b16102b : SUCCESS in 14m 13s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/fe15fb36451941e0bfa104c743d53c8c : SUCCESS in 17m 53s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/5cb334e16a9946cfa82be4b2d0d2e3de : SUCCESS in 39m 49s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/59208b4407f143759e29a439f1afd3bf : FAILURE in 17m 17s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/19b69735a14f425497efa6d2baf07733 : FAILURE in 24m 48s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/70666b2c0cd74dec96d5e4867f532e9f : SUCCESS in 16m 57s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/c0263992456445eebcb1a7cfadc6391c : FAILURE in 37m 28s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/d5eb469cba87433ba481622a98fe1587 : SUCCESS in 23m 09s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/110a4e8701bb47148d35934f998469d1 : SUCCESS in 32m 44s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/43f6ed36e0284f52b1839ecc3f6633c5 : SUCCESS in 43m 22s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/a7176b375a664e889836298350ce00a2 : POST_FAILURE in 9m 36s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"00e8025847c9ef0aa17c2b0b3d0c9a864837e3a7","tag":"autogenerated:gerrit:setHashtag","author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"date":"2026-05-29 06:39:12.000000000","message":"Hashtag added: CVE-2026-43000","accounts_in_message":[],"_revision_number":2},{"id":"6cb2b2a501a2fdb6bcf0dd8362d8297f7c54850b","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-05-29 15:29:23.000000000","message":"Patch Set 2:\n\n(1 comment)","accounts_in_message":[],"_revision_number":2},{"id":"35343ee88fcd5fe525d9ee59ab6de46c21dd46fb","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-29 17:18:23.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/c0a0020a7b5c4494b677291e87f34d90\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/e095ba7aa2e54e99b44d45a294582b92 : SUCCESS in 11m 29s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/cac47c472aeb41bb8c7a4c2369a1a34e : SUCCESS in 6m 27s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/769135cc562447849d72741e5f3b66f3 : SUCCESS in 12m 05s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/3ff5bb8cef2545898ccbfb97dd591ade : SUCCESS in 11m 59s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/49c1a842831d4c52bbb846dc4497780e : SUCCESS in 12m 39s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/276031d8343e46c1adefd50741ffbc63 : SUCCESS in 12m 48s\n- grenade https://zuul.opendev.org/t/openstack/build/303b225cbef84b0ba14ddd57e7a08528 : SUCCESS in 1h 01m 55s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/73a642d3c2dc470486c8392095ec1bcd : SUCCESS in 1h 41m 36s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/eca13b3fb5b4426a8932dd706eaf9f9a : SUCCESS in 8m 06s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/6e66d7c8bf7045c58cb09767ce1fee22 : SUCCESS in 20m 27s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/ee8489a9dbe846ecac6c6fe0993ddc70 : SUCCESS in 14m 31s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/0e8551901dd64700a19faf167d96ec3f : FAILURE in 20m 21s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/8fdd98bead354bada1a6f4a59b7864e0 : FAILURE in 17m 23s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/507df35c74b145cdb21c34e105c37e05 : SUCCESS in 21m 44s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/4989e34fb13d4cdbbcc0d047491ff22f : SUCCESS in 31m 56s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/319e244594854f5d87a4d37d021b2ffd : SUCCESS in 36m 33s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/e158cc71570349f9bcc4df0a9c4b3cdf : SUCCESS in 39m 14s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/09eef321037a45c2900206b230aeda1a : SUCCESS in 44m 24s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/ecc67b5867594235a2be9a357fd44ed4 : SUCCESS in 8m 08s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"8cda45cf92b72cf95bfb0f710f612b8a92063ce8","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-06-01 08:56:23.000000000","message":"Patch Set 2: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":2},{"id":"33366a09ae5646c9c711999b5823445e0d897671","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-01 08:57:09.000000000","message":"Patch Set 2: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":2},{"id":"1257d11f448912d62694a822a820f6648458befd","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-01 12:37:40.000000000","message":"Patch Set 2: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/bf4527ae352d4f3aa1923875a824a2a6\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/7494c799088d43e0b0365e1ecffa78e1 : SUCCESS in 3m 13s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/fb7eaa3014814730a08563faed53f2a4 : SUCCESS in 7m 33s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/dc27204d1fce400f8eb94788aba300bc : SUCCESS in 11m 09s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/d2ef1b161878422f9f71c8ef089aeef6 : SUCCESS in 13m 35s\n- grenade https://zuul.opendev.org/t/openstack/build/77a76ae8948a4e50b8eb3d5ee900b00b : SUCCESS in 1h 02m 25s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/c425f4bd399640c8bc88eb470c049946 : SUCCESS in 1h 27m 17s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/c6a11a6732524b778972f0ed634d07fe : SUCCESS in 5m 17s\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/21c4a5ac06554ef2bb6d399279f33149 : SUCCESS in 13m 50s\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/740eda6d686f40d6a33ae82aaa40bb8a : SUCCESS in 13m 35s\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/90f6fb2e70fa4b06990cf6e4127abd46 : SUCCESS in 41m 09s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/961513aa2c0441f8bb68ae138c87202b : SUCCESS in 38m 12s","accounts_in_message":[],"_revision_number":2},{"id":"a422ff08a4a034d9daf99eaafd4b3e0b84c6d963","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-01 12:37:40.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":2},{"id":"45036f34f52082fab8d193fb8d55d8f0278d4184","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-01 12:39:12.000000000","message":"Patch Set 2:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/2dfbbbc37c104383b1aa22379f1bf616\n\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/4b11220290934134ad493c08d2b319bf : SUCCESS in 1m 06s","accounts_in_message":[],"_revision_number":2}],"current_revision_number":2,"current_revision":"c2126b0a953ee3ab8975fb70b4c5259af26087d0","revisions":{"6d682af3c8b46dcba1e42eef41a000a1f7759389":{"kind":"REWORK","_number":1,"created":"2026-05-28 15:05:47.000000000","uploader":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"ref":"refs/changes/92/990492/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/92/990492/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/92/990492/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/92/990492/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/92/990492/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/92/990492/1"}}},"commit":{"parents":[{"commit":"6890d28bd74cd01ff310fd1a95901d43aa16ae03","subject":"Fix user impersonation through application credentials (CVE-2026-42998)","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/6890d28bd74cd01ff310fd1a95901d43aa16ae03"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-05-12 07:22:47.000000000","tz":120},"committer":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2026-05-22 08:13:20.000000000","tz":120},"subject":"Forbid trust operations using application credentials (CVE-2026-43000)","message":"Forbid trust operations using application credentials (CVE-2026-43000)\n\nPreviously only restricted application credentials were blocked, and only\nfor trust create and delete. This change blocks all application credentials\n(restricted and unrestricted alike) from all trust operations: list, get,\ncreate, delete, list-roles, and get-role. The \u0027unrestricted\u0027 flag governs\ncredential management, not trust management.\n\nCloses-Bug: #2148477\nRelated-Bug: #2149789\nRelated-Bug: #2150089\nAssisted-by: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\nCo-authored-by: Boris Bobrov \u003cb.bobrov@sap.com\u003e\nChange-Id: I750156df18a1d6293ce99c42eb524575fcf16ea3\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\nSigned-off-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\n(cherry picked from commit 3c2043ab003cb4b8aa34502fe9a5a69b0a6a6e54)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/6d682af3c8b46dcba1e42eef41a000a1f7759389"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/6d682af3c8b46dcba1e42eef41a000a1f7759389"}]},"branch":"refs/heads/stable/2026.1"},"c2126b0a953ee3ab8975fb70b4c5259af26087d0":{"kind":"TRIVIAL_REBASE","_number":2,"created":"2026-05-28 21:57:49.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/92/990492/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/92/990492/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/92/990492/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/92/990492/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/92/990492/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/92/990492/2"}}},"commit":{"parents":[{"commit":"8c0e2c7a017e252cc5d422a692b8d52cbbc9a622","subject":"Fix user impersonation through application credentials (CVE-2026-42998)","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/8c0e2c7a017e252cc5d422a692b8d52cbbc9a622"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-05-12 07:22:47.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-05-28 21:56:50.000000000","tz":120},"subject":"Forbid trust operations using application credentials (CVE-2026-43000)","message":"Forbid trust operations using application credentials (CVE-2026-43000)\n\nPreviously only restricted application credentials were blocked, and only\nfor trust create and delete. This change blocks all application credentials\n(restricted and unrestricted alike) from all trust operations: list, get,\ncreate, delete, list-roles, and get-role. The \u0027unrestricted\u0027 flag governs\ncredential management, not trust management.\n\nCloses-Bug: #2148477\nRelated-Bug: #2149789\nRelated-Bug: #2150089\nAssisted-by: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\nCo-authored-by: Boris Bobrov \u003cb.bobrov@sap.com\u003e\nChange-Id: I750156df18a1d6293ce99c42eb524575fcf16ea3\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\nSigned-off-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\n(cherry picked from commit 3c2043ab003cb4b8aa34502fe9a5a69b0a6a6e54)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/c2126b0a953ee3ab8975fb70b4c5259af26087d0"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/c2126b0a953ee3ab8975fb70b4c5259af26087d0"}]},"branch":"refs/heads/stable/2026.1"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}