)]}'
{"id":"openstack%2Fkeystone~990494","triplet_id":"openstack%2Fkeystone~stable%2F2026.1~I295d1ac27faad05a680bb2b3fac8cfa27fa1c4bd","project":"openstack/keystone","branch":"stable/2026.1","attention_set":{},"removed_from_attention_set":{"14250":{"account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"last_update":"2026-05-29 15:29:34.000000000","reason":"\u003cGERRIT_ACCOUNT_14250\u003e replied on the change","reason_account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"}},"27900":{"account":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"last_update":"2026-06-01 13:00:26.000000000","reason":"Change was submitted"}},"hashtags":["CVE-2026-42999"],"change_id":"I295d1ac27faad05a680bb2b3fac8cfa27fa1c4bd","subject":"Prevent RBAC policy bypass via JSON body and query filters (CVE-2026-42999)","status":"MERGED","created":"2026-05-28 15:05:47.000000000","updated":"2026-06-01 13:04:39.000000000","submitted":"2026-06-01 13:00:26.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":1,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"990494","meta_rev_id":"d2436f387926cfa4f8b9e5279a79a10deab3f170","_number":990494,"virtual_id_number":990494,"owner":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-06-01 13:00:26.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"all":[{"value":2,"date":"2026-06-01 08:56:35.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"all":[{"value":1,"date":"2026-06-01 08:56:35.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-05-28 15:05:47.000000000","updated_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"reviewer":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"state":"REVIEWER"},{"updated":"2026-05-28 17:13:09.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"}],"messages":[{"id":"c5721a4a8e9c43ee24b6aabd51d96346cef20c71","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-05-28 15:05:47.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"0eb2659cf9316b1beea257ca2bdfd41376ada9b2","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-28 17:13:09.000000000","message":"Patch Set 1: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/80a456c6ba3e45088ebe03fb4da882b0\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/4c1a860263fc43d485208ec8ecc235fa : SUCCESS in 20m 59s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/01e4e573fd0e4f9abb4856f1e9e027ce : FAILURE in 6m 11s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/2d08665662ea415386a6943986d4afe9 : SUCCESS in 15m 06s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/93cf659536594c9ab3d6e691118de4c3 : SUCCESS in 12m 13s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/1b430544561b4753883d77e231bd90e4 : SUCCESS in 15m 35s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/e9d0399e06d7410cbb6ae4f760bca213 : SUCCESS in 13m 50s\n- grenade https://zuul.opendev.org/t/openstack/build/9d680af14e0a406cb3d0e25a7a2b7b5d : SUCCESS in 41m 29s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/09d05f272d3d437f9f1d19625a60694f : SUCCESS in 1h 53m 18s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/1f299763337c4913a119f4ea3a1fe888 : SUCCESS in 15m 06s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/d06fa92b005b4c35bb061d8528c1b56e : SUCCESS in 13m 01s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/448c4cbd97e8448289efaaa58647b50e : SUCCESS in 27m 19s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/b15dd48df91142b6bbc1532078c3e905 : FAILURE in 10m 34s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/54a05dcae1754ead92e5388f4e454c39 : FAILURE in 15m 04s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/45e37908604a4db58a0a9feb6ebfecfa : SUCCESS in 30m 16s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/547dc09433544adf8a30bdcc44852d22 : FAILURE in 34m 40s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/7d43d8817c4d4e8a99c48d899a409bd2 : SUCCESS in 40m 06s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/c23afd181fdd40a8a713cb62039107e5 : SUCCESS in 1h 10m 22s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/fbd37d32020d491cb078dfc105e54f76 : SUCCESS in 39m 17s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/4e53a59a19804efa82f68ad597717aac : SUCCESS in 8m 10s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"44f697687e8ea4aa825e3f5c31bef910d3c9b097","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-05-28 21:57:56.000000000","message":"Uploaded patch set 2: Patch Set 1 was rebased.\n\nOutdated Votes:\n* Verified-1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":2},{"id":"dd76f84bd25cd2505fb4ac61ed52b4f668eae8a4","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-28 23:49:56.000000000","message":"Patch Set 2: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/d734634caef14c908ea4ceef2a1b8c09\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/1ff1e46ed1e64065b943c428d1d1cc69 : SUCCESS in 12m 50s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/7b09df0a7cf34623b9a1051ddc1506e1 : SUCCESS in 3m 54s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/19c73e353d8744f9b72e6b1a99cb64cb : SUCCESS in 12m 56s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/1d1b030a833d4825a2b2137b4e8e01d1 : SUCCESS in 11m 58s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/369a8126d9704088bb5e4579a04fb7c4 : SUCCESS in 12m 09s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/a60eb3426ff74e9a90e6ef2ff30849ee : SUCCESS in 14m 09s\n- grenade https://zuul.opendev.org/t/openstack/build/bee0106d0b59445e97a0d22fea9949e0 : SUCCESS in 38m 41s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/5281a926336b42f4b013f73fc3616632 : SUCCESS in 1h 46m 32s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/615dbffcbbe14ef183f36db66468b1c2 : SUCCESS in 12m 13s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/0744f5b1f1ac46ce849761bfe602c5eb : SUCCESS in 9m 54s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/59b5ffa285864f0ca170bf25c1393e46 : SUCCESS in 16m 21s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/def5de2e4c164520a68dc4683723a42c : FAILURE in 11m 06s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/2e47a84a49824f75ab27b166d059d38e : FAILURE in 16m 56s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/a997c87e820d4e56b2ddfa5b2ac478b0 : SUCCESS in 32m 46s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/6c2bf433093c4dde81d13b4a868fee84 : FAILURE in 35m 10s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/1b9fc3f363794b93a4fbbe22f161030d : SUCCESS in 21m 11s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/dd2b16b572d4445287d87830db81da60 : SUCCESS in 56m 03s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/a7d5665f603147bfb9cb936bdb7730a6 : SUCCESS in 32m 51s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/6c821105bda64f35a00505912a3a2f46 : SUCCESS in 8m 25s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"93cd8c1955c79f80c27e018f76b9233df20361e3","tag":"autogenerated:gerrit:setHashtag","author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"date":"2026-05-29 06:39:16.000000000","message":"Hashtag added: CVE-2026-42999","accounts_in_message":[],"_revision_number":2},{"id":"3234166674052e8983b2eb44622cab5d5a5efaf1","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-05-29 15:29:34.000000000","message":"Patch Set 2:\n\n(1 comment)","accounts_in_message":[],"_revision_number":2},{"id":"3f952230985a230251f9ecee299afa2722c83495","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-29 16:38:23.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/4c979d34df6448b78e8837813b3e6285\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/74a1ee6aae4c4ea7b23051dea2900853 : SUCCESS in 16m 41s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/57e5a196ca774179a2a2a43263bc61f1 : SUCCESS in 7m 24s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/e0a935ca3f3241e3a46e9b1a978c5c0c : SUCCESS in 10m 00s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/26cd0218968e486eb962bf489d90ffd8 : SUCCESS in 12m 12s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/ca9bbe5626af466fbd4ba0fb37cb0271 : SUCCESS in 17m 19s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/70695f64f9b7447fad21f5b0e0c68f5c : SUCCESS in 16m 07s\n- grenade https://zuul.opendev.org/t/openstack/build/5228e9a12c8f49a08bf4d8411946d950 : SUCCESS in 44m 11s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/73716a1f855d48b592de2688cc55bfa6 : SUCCESS in 1h 06m 34s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/0b1e66f993774e9e81203f0e969547e0 : SUCCESS in 11m 41s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/1ae21a06a9544343ba45f73c1c57ff85 : SUCCESS in 11m 17s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/c39b45d935e54a95afe533e238fc5ad5 : SUCCESS in 30m 52s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/e7af275149b94f68a468908cabe4dede : FAILURE in 11m 47s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/c43c1891c82f488bae337ab476b99f2b : FAILURE in 29m 55s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/8796d63528464aeba9b909e32e79e176 : SUCCESS in 30m 52s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/6340c681e7d342d19bd0a4f5bcae2ff8 : SUCCESS in 34m 30s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/b517e3abf6a644ee8f297aaf2c60b514 : SUCCESS in 35m 22s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/09b0316e06764884ad5e9b33b77ef076 : SUCCESS in 1h 02m 49s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/67aa673629c244d7b138d5271e4cd09d : SUCCESS in 45m 40s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/a6747ce2faf5495280e90e4b87c56e6d : MERGE_CONFLICT in 1m 02s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"e913e1449166040c918e19b1cff0aa4ceae4a287","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-06-01 08:56:35.000000000","message":"Patch Set 2: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":2},{"id":"fa4834df51a225fb1e635d629bead0844bb642fa","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-01 08:57:24.000000000","message":"Patch Set 2: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":2},{"id":"b69de59076540cff9aa5aae077a2ef7cba1e2f1e","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-01 13:00:26.000000000","message":"Patch Set 2: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/babb051ed1a84638894643d2727fb71e\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/bcdefb7c953e459093e11f8b03895e2e : SUCCESS in 5m 11s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/272690b3a81a4997ba93ebfbca00f863 : SUCCESS in 7m 34s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/c578db2e78de4762bae38e483854d29a : SUCCESS in 11m 09s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/7633b20f292f485faecbbb417fb92bf4 : SUCCESS in 13m 38s\n- grenade https://zuul.opendev.org/t/openstack/build/c3231f529dbb4ae7a7d44e145b2a9c90 : SUCCESS in 1h 06m 55s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/3424cca202f64bec9e6985a77c103e24 : SUCCESS in 55m 49s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/cb7dcd8135c1432793cc90c55d11cbe1 : SUCCESS in 12m 26s\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/f8830e6f465643a3bbf2cc70894f3d64 : SUCCESS in 31m 59s\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/d2650a31f88d425fa98aa2a4bc0d03af : SUCCESS in 13m 41s\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/b1bffdfd6b124e279b3cee0d227ba793 : SUCCESS in 58m 28s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/03e9459ebb354f0097cd11b2e136dd79 : SUCCESS in 18m 09s","accounts_in_message":[],"_revision_number":2},{"id":"cd603b1ed6fd355fcfd6eda130f8900fdbfbafaf","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-01 13:00:26.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":2},{"id":"d2436f387926cfa4f8b9e5279a79a10deab3f170","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-01 13:04:39.000000000","message":"Patch Set 2:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/17db6cd324bc45c4a8e1cca43f8542fc\n\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/92df29783ac24849aac855a459202c25 : SUCCESS in 1m 19s\n- promote-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/d465b0fea5b5474482af3fd61f087599 : SUCCESS in 1m 11s","accounts_in_message":[],"_revision_number":2}],"current_revision_number":2,"current_revision":"e3fe5cb3efe4996ea677b39c91e276050097ecf0","revisions":{"58107ed59c7464482ef0350d035224db4982904b":{"kind":"REWORK","_number":1,"created":"2026-05-28 15:05:47.000000000","uploader":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"ref":"refs/changes/94/990494/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/94/990494/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/94/990494/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/94/990494/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/94/990494/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/94/990494/1"}}},"commit":{"parents":[{"commit":"8dfb0852fff22dab02c45dfc46188c7fab89d9cc","subject":"Preserve expires_at when rescoping federated tokens (CVE-2026-44394)","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/8dfb0852fff22dab02c45dfc46188c7fab89d9cc"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-05-12 07:10:20.000000000","tz":120},"committer":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2026-05-22 08:13:20.000000000","tz":120},"subject":"Prevent RBAC policy bypass via JSON body and query filters (CVE-2026-42999)","message":"Prevent RBAC policy bypass via JSON body and query filters (CVE-2026-42999)\n\nThe RBAC enforcer unconditionally merged the raw JSON request body into\nthe policy enforcement dictionary after trusted target data had been set\nfrom the database. An attacker could include a \"target\" key in the JSON\nbody to overwrite database-sourced RBAC target attributes, causing all\n%(target.*)s policy substitutions to evaluate against attacker-controlled\nvalues. This affected 88 endpoint/method combinations across all Keystone\nAPI resources.\n\nThe fix namespaces user-controlled JSON body data under a \"request_body\"\nkey in the policy dict, making it structurally impossible for request body\nfields to collide with internal keys like \"target\" or view_args.\n\nThe only in-tree policy rule that depended on the old JSON body merge\nbehavior was identity:create_trust, which referenced\n%(trust.trustor_user_id)s from the request body at the top level of the\npolicy dict. This is updated to use target_attr and the\n%(target.trust.trustor_user_id)s substitution, consistent with all other\ntrust policy rules.\n\nAdditionally, query-string filter values had the same structural issue:\n_extract_filter_values() results were merged at the top level, meaning a\nfilter key matching a view_arg key (e.g. user_id on\n/v3/users/{user_id}/... endpoints using ADMIN_OR_SYSTEM_READER_OR_OWNER)\ncould be overwritten by an attacker-controlled ?user_id\u003d query param,\nbypassing ownership checks. Filter values are now namespaced under\n\"filter_attr\". No in-tree policy rule references filter values via %(key)s\nsubstitutions, so this is backwards-compatible for upstream deployments.\n\nCloses-Bug: #2148398\nAssisted-by: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\nCo-authored-by: Boris Bobrov \u003cb.bobrov@sap.com\u003e\nCo-authored-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\nChange-Id: I295d1ac27faad05a680bb2b3fac8cfa27fa1c4bd\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n(cherry picked from commit 22b51f5d5d86350d3fbc66697e4097bacf2a8ce9)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/58107ed59c7464482ef0350d035224db4982904b"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/58107ed59c7464482ef0350d035224db4982904b"}]},"branch":"refs/heads/stable/2026.1"},"e3fe5cb3efe4996ea677b39c91e276050097ecf0":{"kind":"TRIVIAL_REBASE","_number":2,"created":"2026-05-28 21:57:56.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/94/990494/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/94/990494/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/94/990494/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/94/990494/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/94/990494/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/94/990494/2"}}},"commit":{"parents":[{"commit":"4381601f2f2ac648417b88480f4cd03b1e0e5f62","subject":"Preserve expires_at when rescoping federated tokens (CVE-2026-44394)","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/4381601f2f2ac648417b88480f4cd03b1e0e5f62"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-05-12 07:10:20.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-05-28 21:56:51.000000000","tz":120},"subject":"Prevent RBAC policy bypass via JSON body and query filters (CVE-2026-42999)","message":"Prevent RBAC policy bypass via JSON body and query filters (CVE-2026-42999)\n\nThe RBAC enforcer unconditionally merged the raw JSON request body into\nthe policy enforcement dictionary after trusted target data had been set\nfrom the database. An attacker could include a \"target\" key in the JSON\nbody to overwrite database-sourced RBAC target attributes, causing all\n%(target.*)s policy substitutions to evaluate against attacker-controlled\nvalues. This affected 88 endpoint/method combinations across all Keystone\nAPI resources.\n\nThe fix namespaces user-controlled JSON body data under a \"request_body\"\nkey in the policy dict, making it structurally impossible for request body\nfields to collide with internal keys like \"target\" or view_args.\n\nThe only in-tree policy rule that depended on the old JSON body merge\nbehavior was identity:create_trust, which referenced\n%(trust.trustor_user_id)s from the request body at the top level of the\npolicy dict. This is updated to use target_attr and the\n%(target.trust.trustor_user_id)s substitution, consistent with all other\ntrust policy rules.\n\nAdditionally, query-string filter values had the same structural issue:\n_extract_filter_values() results were merged at the top level, meaning a\nfilter key matching a view_arg key (e.g. user_id on\n/v3/users/{user_id}/... endpoints using ADMIN_OR_SYSTEM_READER_OR_OWNER)\ncould be overwritten by an attacker-controlled ?user_id\u003d query param,\nbypassing ownership checks. Filter values are now namespaced under\n\"filter_attr\". No in-tree policy rule references filter values via %(key)s\nsubstitutions, so this is backwards-compatible for upstream deployments.\n\nCloses-Bug: #2148398\nAssisted-by: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\nCo-authored-by: Boris Bobrov \u003cb.bobrov@sap.com\u003e\nCo-authored-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\nChange-Id: I295d1ac27faad05a680bb2b3fac8cfa27fa1c4bd\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n(cherry picked from commit 22b51f5d5d86350d3fbc66697e4097bacf2a8ce9)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/e3fe5cb3efe4996ea677b39c91e276050097ecf0"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/e3fe5cb3efe4996ea677b39c91e276050097ecf0"}]},"branch":"refs/heads/stable/2026.1"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}