)]}'
{"id":"openstack%2Fkeystone~990496","triplet_id":"openstack%2Fkeystone~stable%2F2025.2~I2fe6089886eebf3775930451b87771e40b5e179e","project":"openstack/keystone","branch":"stable/2025.2","attention_set":{},"removed_from_attention_set":{"14250":{"account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"last_update":"2026-06-08 18:34:59.000000000","reason":"Change was submitted"},"27900":{"account":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"last_update":"2026-06-08 16:56:17.000000000","reason":"\u003cGERRIT_ACCOUNT_27900\u003e replied on the change","reason_account":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}}},"hashtags":["CVE-2026-42998"],"change_id":"I2fe6089886eebf3775930451b87771e40b5e179e","subject":"Fix user impersonation through application credentials (CVE-2026-42998)","status":"MERGED","created":"2026-05-28 15:06:15.000000000","updated":"2026-06-08 18:39:13.000000000","submitted":"2026-06-08 18:34:59.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":1,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"990496","meta_rev_id":"d1dbf31f800028ebba3564ac593a22304d07ce31","_number":990496,"virtual_id_number":990496,"owner":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":0,"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-06-08 18:34:59.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"all":[{"value":2,"date":"2026-06-03 12:05:55.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":2,"date":"2026-06-08 16:56:17.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"all":[{"value":0,"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":1,"date":"2026-06-08 16:56:17.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-05-28 15:06:15.000000000","updated_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"reviewer":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"state":"REVIEWER"},{"updated":"2026-05-28 16:50:57.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"}],"messages":[{"id":"3e14ecb6c3b6b4c4a782978d01767340e5f02448","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-05-28 15:06:15.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"1633a36470add0cfd2ed10dae567c9fabb953fa0","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-28 16:50:57.000000000","message":"Patch Set 1: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/eb952e93895b47de9dc672c8030cb4e4\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/35e06915ac594e11be257dead4cb1229 : SUCCESS in 17m 53s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/742725c0caff40b1950a00f31c0e3a85 : FAILURE in 7m 04s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/c7162819a631477597bd0570ee934381 : SUCCESS in 13m 38s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/eefc5c98130a47179f4f3a8cb3009669 : SUCCESS in 12m 37s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/715ff61020884b1fa91bac9a172c71b6 : SUCCESS in 17m 57s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/1416f454c87841aea7d35320eeb97c3c : SUCCESS in 14m 37s\n- grenade https://zuul.opendev.org/t/openstack/build/36e9e3577e9d48fc99f0d83b80e6e016 : SUCCESS in 1h 05m 47s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/a2c9cb84337f4947b86140ce34f73ffb : SUCCESS in 1h 35m 24s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/a091ab784489428bb28e3df4092120d9 : SUCCESS in 13m 19s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/aca85d7f8da847c9bed1d7b7eaa033a2 : SUCCESS in 15m 20s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/60f81c55a5b44fb480cf5e43ed570ccc : SUCCESS in 26m 27s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/75966d6bca8344bea8773dbbf1231e74 : FAILURE in 18m 53s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/9dc45d1550144a92aefde0e605505ad5 : FAILURE in 24m 47s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/fb7a167123354c709d804f52d5ecf382 : FAILURE in 31m 33s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/42ad7386efc34554bf194b8a9f2d8743 : FAILURE in 35m 48s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/c3a436bd7f7b4577b5a6691b5d24580d : SUCCESS in 30m 00s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/035c5b5e75c048e3b546f5532fd41ffb : SUCCESS in 1h 05m 13s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/95fc8bfbbd424413a33e76660fb502c7 : FAILURE in 30m 06s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/f9e1b26b6b0047f2a3b805c15eebe6b7 : FAILURE in 8m 40s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"9bde1483280332206e909878ef20c2f0940314b9","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-05-28 21:58:08.000000000","message":"Uploaded patch set 2: Patch Set 1 was rebased.\n\nOutdated Votes:\n* Verified-1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":2},{"id":"6f99a1e432343a6851518f1dfa232f3cc2abf4ed","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-28 23:45:14.000000000","message":"Patch Set 2: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/4b86c0076e1c47bca25ba24e57d9fd5d\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/d97b267d348e4f93b2be64ed6fdca050 : SUCCESS in 12m 40s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/c730bd0bacf24648ae84bf44e239d8be : SUCCESS in 7m 02s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/3b1bbaded6fe4da499445657a45cd081 : SUCCESS in 13m 36s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/fb7088fa9e96421896fa8c2aca5f8b6f : SUCCESS in 11m 11s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/275e93c3370b43eda45819f0c2877603 : SUCCESS in 16m 11s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/6bd14d227c0e482a8d3c1fee9ed1fdce : SUCCESS in 14m 14s\n- grenade https://zuul.opendev.org/t/openstack/build/f003064f313d47359f21cb0dfde5e853 : SUCCESS in 1h 04m 44s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/22b164ae8710441eb46311f13bac1f28 : SUCCESS in 1h 40m 21s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/25a98d9cb2274436ad1b8578c5fe64b6 : SUCCESS in 13m 30s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/b998b2f74a5a4d5191c7201bf7cdba8b : SUCCESS in 19m 39s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/a8651f41c9474699afc3a05085f22a5f : SUCCESS in 33m 35s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/f3878af0332e4ca99ab5cc425363820b : FAILURE in 9m 26s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/659ec78dd00e4dbb947c6c9c26cb6c8b : FAILURE in 24m 13s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/cf97f230d7ae49bdae9b9460c404df59 : FAILURE in 16m 28s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/f82684ffaa324bd884e35d727c566dd0 : FAILURE in 31m 22s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/387c13d7e3264539b0bbf47b7f7f0105 : SUCCESS in 25m 11s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/044a8de245684bcd938597cef20bcfca : SUCCESS in 58m 33s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/ad5ee22c690f47a1948515333c4a0b7b : FAILURE in 40m 30s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/fd1b292c97954932888e71b0c8e25e00 : FAILURE in 9m 07s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"4369059657a9733326d0b3f8315bcf2bf8d67b05","tag":"autogenerated:gerrit:setHashtag","author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"date":"2026-05-29 06:39:11.000000000","message":"Hashtag added: CVE-2026-42998","accounts_in_message":[],"_revision_number":2},{"id":"5a58efe3e1a6a01c1e5097adbb71ea8bc4ca5e24","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-06-03 12:05:22.000000000","message":"Patch Set 2:\n\n(1 comment)","accounts_in_message":[],"_revision_number":2},{"id":"1241ac45b05e1bbdc0b2ebae49db926250520abc","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-06-03 12:05:55.000000000","message":"Patch Set 2: Code-Review+2","accounts_in_message":[],"_revision_number":2},{"id":"bb412b459f25b8969978d9425e1d28e07092f7d2","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-03 13:13:17.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/6a218fbc0d5e426484ce5284847c8209\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/62f16f8bc4a4484aa89f98046923086f : SUCCESS in 17m 52s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/032d0156ad8d4c6888ad4a92cfc87bfd : SUCCESS in 4m 16s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/b525f5a922d34dd2bbb1ef144ee42195 : SUCCESS in 10m 46s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/05489ef59f714169adeb46d3cca7bb27 : SUCCESS in 11m 00s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/c7dbc9af43a246caa2efb1620ce05777 : SUCCESS in 10m 31s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/a3f27413278e46c89192ad775e2582a5 : SUCCESS in 15m 57s\n- grenade https://zuul.opendev.org/t/openstack/build/d4fcc915b0be40089eaf4cb882658aab : SUCCESS in 51m 07s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/daeb5af435f54d1f81d2518c63ac13d4 : SUCCESS in 59m 32s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/0ca7bb03cd7a4156be14f0669634d8c8 : SUCCESS in 5m 37s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/2342211ad55d40aaa9ac9a394c9fd28d : SUCCESS in 10m 07s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/092c7d3241f847c6b156cc8bcdaf298c : SUCCESS in 28m 21s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/19d823959dd347d392ba852d1ba80c50 : FAILURE in 18m 21s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/14bc09ce2dd84a00ba13883d123ffaae : FAILURE in 24m 04s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/76b566d99c2f452fbc0a7e8fcef10be0 : SUCCESS in 30m 27s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/acdbd384b9a24f57b854e48581bf7afc : SUCCESS in 21m 26s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/83b17eecfb104fbd903ae80f5c4d7097 : SUCCESS in 28m 20s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/0f498ad418604a6fb81689ac2cb86310 : SUCCESS in 47m 51s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/99e674cc622f436daaf6b0558e8d23c5 : SUCCESS in 50m 13s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/516f93c998ee453d8380c7266de9aa3b : FAILURE in 8m 13s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"051df63e23e508898c1216e17c01ef1ea9c43708","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-06-08 16:56:17.000000000","message":"Patch Set 2: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":2},{"id":"9f6c5d289b7f9bfbb74a8bdd7e4b1e94b830c1c5","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-08 16:57:28.000000000","message":"Patch Set 2: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":2},{"id":"ca9de3e457cf5a21fd1f2640dd9b8c4c166de3f4","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-08 18:34:59.000000000","message":"Patch Set 2: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/684a5838ce714de78455276b8c628993\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/92865ec59d5543078daa2a05bc351215 : SUCCESS in 8m 50s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/0455069963894d018c18c231f3aee428 : SUCCESS in 13m 27s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/91a0350d509a45e69012ed53a0c04676 : SUCCESS in 8m 14s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/52a56a750033466d8537ef64dbee3a4f : SUCCESS in 15m 17s\n- grenade https://zuul.opendev.org/t/openstack/build/7f1812ca6a7446db93194aa3fb2e50ba : SUCCESS in 31m 25s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/2ccbf107493244588fa38ce8be791ab6 : SUCCESS in 1h 35m 18s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/360112b223e04dab9b64d95600defc38 : SUCCESS in 5m 22s\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/f6c9fe3321ce45a2ac6a924654d071aa : SUCCESS in 30m 16s\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/426b45a2aac842bebc8e32bb7166fac4 : SUCCESS in 29m 23s\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/9cba8fbd70f14fad962056136f664051 : SUCCESS in 1h 01m 01s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/994eeef09c4543f58fee99387d823aba : SUCCESS in 49m 28s","accounts_in_message":[],"_revision_number":2},{"id":"3c5a697f8cc46a2f00dc16b07559806ac7873906","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-08 18:34:59.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":2},{"id":"d1dbf31f800028ebba3564ac593a22304d07ce31","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-08 18:39:13.000000000","message":"Patch Set 2:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/96b8686d1dd641178c279e6c7c5ecc3f\n\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/edadd4b848df45d8bedfb35a6b98d073 : SUCCESS in 1m 07s","accounts_in_message":[],"_revision_number":2}],"current_revision_number":2,"current_revision":"8e1ec7d6af44c4f183cf7c9ebe14a1dc94f001fa","revisions":{"74ab55e6b2161264f16f9f0d006ff06b56d6e480":{"kind":"REWORK","_number":1,"created":"2026-05-28 15:06:15.000000000","uploader":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"ref":"refs/changes/96/990496/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/96/990496/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/96/990496/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/96/990496/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/96/990496/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/96/990496/1"}}},"commit":{"parents":[{"commit":"a1f67825be712985a056a97952434a9ec089f799","subject":"Enforce delegation project boundary for delegated tokens","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/a1f67825be712985a056a97952434a9ec089f799"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-05-12 07:22:34.000000000","tz":120},"committer":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2026-05-22 08:18:41.000000000","tz":120},"subject":"Fix user impersonation through application credentials (CVE-2026-42998)","message":"Fix user impersonation through application credentials (CVE-2026-42998)\n\nWhen authenticating by application credential ID, the caller can supply a\n\u0027user\u0027 field in the payload. AppCredInfo conditionally set the user from\nthe credential owner only when no user field was present. If present,\nBaseUserInfo resolved the caller-supplied user and attributed the resulting\ntoken to that user instead of the credential owner.\n\nFix: always set auth_payload[\u0027user\u0027] from the credential\u0027s stored user_id,\nignoring any caller-supplied value.\n\nCloses-Bug: #2148477\nAssisted-by: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\nCo-authored-by: Boris Bobrov \u003cb.bobrov@sap.com\u003e\nChange-Id: I2fe6089886eebf3775930451b87771e40b5e179e\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\nSigned-off-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\n(cherry picked from commit 6cd25fecdab8b9261e916ee10f3dba5aeb0c1984)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/74ab55e6b2161264f16f9f0d006ff06b56d6e480"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/74ab55e6b2161264f16f9f0d006ff06b56d6e480"}]},"branch":"refs/heads/stable/2025.2"},"8e1ec7d6af44c4f183cf7c9ebe14a1dc94f001fa":{"kind":"TRIVIAL_REBASE","_number":2,"created":"2026-05-28 21:58:08.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/96/990496/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/96/990496/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/96/990496/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/96/990496/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/96/990496/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/96/990496/2"}}},"commit":{"parents":[{"commit":"fda177eb5a94ad6377fa912e44c90a3ccdb67f16","subject":"Enforce delegation project boundary for delegated tokens","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/fda177eb5a94ad6377fa912e44c90a3ccdb67f16"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-05-12 07:22:34.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-05-28 21:56:58.000000000","tz":120},"subject":"Fix user impersonation through application credentials (CVE-2026-42998)","message":"Fix user impersonation through application credentials (CVE-2026-42998)\n\nWhen authenticating by application credential ID, the caller can supply a\n\u0027user\u0027 field in the payload. AppCredInfo conditionally set the user from\nthe credential owner only when no user field was present. If present,\nBaseUserInfo resolved the caller-supplied user and attributed the resulting\ntoken to that user instead of the credential owner.\n\nFix: always set auth_payload[\u0027user\u0027] from the credential\u0027s stored user_id,\nignoring any caller-supplied value.\n\nCloses-Bug: #2148477\nAssisted-by: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\nCo-authored-by: Boris Bobrov \u003cb.bobrov@sap.com\u003e\nChange-Id: I2fe6089886eebf3775930451b87771e40b5e179e\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\nSigned-off-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\n(cherry picked from commit 6cd25fecdab8b9261e916ee10f3dba5aeb0c1984)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/8e1ec7d6af44c4f183cf7c9ebe14a1dc94f001fa"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/8e1ec7d6af44c4f183cf7c9ebe14a1dc94f001fa"}]},"branch":"refs/heads/stable/2025.2"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}