)]}'
{"id":"openstack%2Fkeystone~990499","triplet_id":"openstack%2Fkeystone~stable%2F2025.2~I295d1ac27faad05a680bb2b3fac8cfa27fa1c4bd","project":"openstack/keystone","branch":"stable/2025.2","attention_set":{},"removed_from_attention_set":{"14250":{"account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"last_update":"2026-06-10 06:06:26.000000000","reason":"Change was submitted"},"27900":{"account":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"last_update":"2026-06-10 06:06:26.000000000","reason":"Change was submitted"}},"hashtags":["CVE-2026-42999"],"change_id":"I295d1ac27faad05a680bb2b3fac8cfa27fa1c4bd","subject":"Prevent RBAC policy bypass via JSON body and query filters (CVE-2026-42999)","status":"MERGED","created":"2026-05-28 15:06:15.000000000","updated":"2026-06-10 06:07:33.000000000","submitted":"2026-06-10 06:06:26.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":3,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"990499","meta_rev_id":"f780d819b5ee9bfcf76c6789f689a7e9d9742613","_number":990499,"virtual_id_number":990499,"owner":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-06-10 06:06:26.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"all":[{"value":2,"date":"2026-06-03 12:06:08.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":2,"date":"2026-06-08 16:56:54.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"all":[{"value":0,"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":1,"date":"2026-06-08 16:56:54.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"CC":[{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"}],"REVIEWER":[{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-05-28 15:06:15.000000000","updated_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"reviewer":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"state":"REVIEWER"},{"updated":"2026-05-28 16:57:41.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-06-09 14:52:07.000000000","updated_by":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"reviewer":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"state":"CC"}],"messages":[{"id":"933100316aa164044f078e1d2ba999d220b7d4a8","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-05-28 15:06:15.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"e1760c7fb098ba68471abf2544ea9dbe7ae89c17","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-28 16:57:41.000000000","message":"Patch Set 1: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/0e7fc2bfb70748379389e6cb4d423233\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/9a42ad4ae588495d9f0ed45bbadd4848 : SUCCESS in 25m 48s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/163247106f844bdca2ae73c3d296788e : FAILURE in 7m 08s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/589bf88e239241bb8a28a29de073dcfc : SUCCESS in 15m 11s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/24b7261d627e40c4b4beff5cb3f736fb : SUCCESS in 9m 42s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/ee86b23561fb4fb1b70271dbf855c42c : SUCCESS in 19m 08s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/88f53ba612424380a5ea795495369ff6 : SUCCESS in 13m 20s\n- grenade https://zuul.opendev.org/t/openstack/build/3031b2a222e64db8af81475bd31f6ce8 : SUCCESS in 1h 07m 04s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/bdadec18039f4bf6a0ef8c39cf50706e : SUCCESS in 1h 35m 16s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/114e9cf103be48a79035d46ee221a245 : SUCCESS in 12m 15s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/011c9f9503d94a0c935c3af67df5c440 : SUCCESS in 14m 22s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/e776ce8bc9b64bc2aa3e406e10f71bb5 : SUCCESS in 32m 14s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/bc7a1d26aa564e06801bee46a8266faf : FAILURE in 18m 27s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/c5cc369300284e5abcc7e38dc9e7807b : FAILURE in 19m 19s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/efd81881ed234c75badaa193d3fcc119 : FAILURE in 18m 28s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/94b827e921ce43b3a0f0137817592238 : FAILURE in 31m 05s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/2d92bbe598134b8799243c037ccb0a85 : SUCCESS in 27m 06s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/8b714034070c4f639a332962c8325dc3 : SUCCESS in 42m 10s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/f7b98632183a49a4aa2b03a75444e157 : FAILURE in 24m 43s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/269230d9efb74b2db10274aa779b2f85 : FAILURE in 8m 17s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"cdf5722fcda1d8272c1a26b16ed477547f961297","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-05-28 21:58:18.000000000","message":"Uploaded patch set 2: Patch Set 1 was rebased.\n\nOutdated Votes:\n* Verified-1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":2},{"id":"d8a3b515ced9d06f3861ebdf4634d8eb633828e6","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-28 23:13:17.000000000","message":"Patch Set 2: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/fce790b82a7b473dbfd679e56a44b526\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/8ea63241f302425c8e9795728750a9a1 : SUCCESS in 10m 43s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/221479629a3d4a758f136993d19f82f5 : SUCCESS in 6m 53s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/7cdccf665fda47618b32b1c06a8cbdf7 : SUCCESS in 13m 46s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/df69c92db7a541ad864d60fd7173a70d : SUCCESS in 13m 52s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/e9e9d8448124483c90f627a27eae758d : SUCCESS in 14m 03s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/f0bdb85deb824d4cbc3414c861630d7d : SUCCESS in 14m 41s\n- grenade https://zuul.opendev.org/t/openstack/build/011b2ab7b6d047a98bcff973b651b8a9 : SUCCESS in 1h 04m 24s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/d71cd092f80c40748d3c85312fad011b : SUCCESS in 55m 21s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/eb271b57aac64f609c425dc7a37b7c43 : SUCCESS in 13m 01s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/5c0f657768a841ba95f6ed03ee7f3200 : SUCCESS in 18m 31s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/ae3605f05cfb4265b72595551774d1c2 : SUCCESS in 31m 48s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/6841f77c4a3d4f078338011d54ad43ef : FAILURE in 11m 05s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/c6ccb889625b496c9af26b4ec0db2090 : FAILURE in 17m 58s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/f8a33f3261664cff92bf0f061f1f5167 : FAILURE in 18m 48s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/b80980e71f2d4efc939245c0b5db5e5d : FAILURE in 31m 40s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/55fdcd6e80a147ecafee0d31750f793b : SUCCESS in 19m 11s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/32af5bccba39454c87d127c4006d2905 : SUCCESS in 49m 51s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/db14e461147b4eee840c4d0a92fcfc7c : FAILURE in 44m 25s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/a699971b27be4ef89f15e4dc60fd1f52 : FAILURE in 7m 24s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"6f921e3d60dd7ad3d5671d7a398085c8783f7d50","tag":"autogenerated:gerrit:setHashtag","author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"date":"2026-05-29 06:39:17.000000000","message":"Hashtag added: CVE-2026-42999","accounts_in_message":[],"_revision_number":2},{"id":"54349e3ae632dfccae154ffa6a94e846017cf786","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-06-03 12:05:44.000000000","message":"Patch Set 2:\n\n(1 comment)","accounts_in_message":[],"_revision_number":2},{"id":"ce4e36964dc5c180bd05ceab4821b49e2bab219d","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-06-03 12:06:08.000000000","message":"Patch Set 2: Code-Review+2","accounts_in_message":[],"_revision_number":2},{"id":"aeb7444350c6029771db58d07593235d256409c1","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-03 14:09:20.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/aeff3df254ad4316aa38c48118c09840\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/175e15afc18346aaaae3e5a619c34796 : SUCCESS in 17m 28s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/9c31c90a9573497b9d435ba2e168d4a1 : SUCCESS in 7m 35s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/456e60aa1f5242e7b4a15317efadb915 : SUCCESS in 13m 29s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/5bf2486406644cddb1e153a0ec56329b : SUCCESS in 12m 21s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/5e8e68d4139f4aaa809c7a40fd4c1bed : SUCCESS in 17m 20s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/f89a1d8271fc48e9b4e5d8ec4246afdc : SUCCESS in 14m 42s\n- grenade https://zuul.opendev.org/t/openstack/build/d256b7648260487cbab5b84073dc65ef : SUCCESS in 1h 01m 32s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/36ae2ebf62474c44b946a3272c445207 : SUCCESS in 1h 47m 01s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/eb80125c5d774c4486c3aaaac2c7104e : SUCCESS in 13m 02s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/b83106f2631646d69295bb4546ace4f8 : SUCCESS in 18m 26s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/8d57a0a5df294ea6bc7365ad432c5cac : SUCCESS in 31m 26s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/b9f53ab624a44845943307753a790aff : FAILURE in 18m 08s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/f480f0230554485fab02488c1c61a41a : FAILURE in 28m 17s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/83576f7b627c4468b2db6cd1600e7216 : SUCCESS in 32m 08s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/96647084b72c4c849742e66a189ff7e8 : SUCCESS in 30m 55s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/8accd294ed3042c7ba31a15172ecc7de : SUCCESS in 40m 35s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/4539c73fa4e14e9791a9611d8d4812f3 : SUCCESS in 56m 14s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/93fa25aeec8e450193147c35f4f36684 : SUCCESS in 47m 26s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/4c203f5c707645f3b6307e9b992480a8 : FAILURE in 7m 56s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"b99e3e9fa43893fe4283477b53678b2472dd88d9","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-06-08 16:56:54.000000000","message":"Patch Set 2: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":2},{"id":"9f650285cddef8b1d153dfc511e5ea261a5800f1","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-08 16:58:11.000000000","message":"Patch Set 2: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":2},{"id":"7b713047636db6a215a070692a0723a0874b1a7d","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-08 18:52:22.000000000","message":"Patch Set 2: Verified-2\n\nThis change depends on a change that failed to merge.\n\nChange https://review.opendev.org/c/openstack/keystone/+/990498 is needed.","accounts_in_message":[],"_revision_number":2},{"id":"37c093e71bf475037d4669c9e8d9c42225278407","author":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"date":"2026-06-09 14:52:07.000000000","message":"Patch Set 2:\n\n(1 comment)","accounts_in_message":[],"_revision_number":2},{"id":"1fce820d0b751edbd4ae92e422b86f150e58e76c","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-09 16:12:21.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/da790979395144e1a5e76525e748355c\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/a5c54a23a4b14ff48a0e42393c81fd7b : SUCCESS in 10m 23s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/2dc15de261f544f7857fd2c272140938 : SUCCESS in 6m 22s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/27ab4dfd06ac49088a98ef8f0d06f949 : SUCCESS in 11m 53s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/d7d591d2f8074451bd2bac6f4f1b27f6 : SUCCESS in 14m 39s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/01849669238e40fdbe613c4c3b73cd93 : SUCCESS in 9m 34s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/16daa63c002047a1ba5b89b79ee05db0 : SUCCESS in 15m 12s\n- grenade https://zuul.opendev.org/t/openstack/build/1660771c475648aa9141eeeed0ab803e : SUCCESS in 1h 13m 53s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/b39a4049d9a94813871c8df92733d384 : SUCCESS in 58m 54s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/cdd31824af92400db2916300b0cb498b : SUCCESS in 12m 10s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/cfa4deb4aded45839719799c42b29e43 : SUCCESS in 19m 31s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/f0561fb026bd4f34a1eaf61a7dba0c13 : SUCCESS in 27m 39s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/10c28db2935e4e4d92233ce4ebb46139 : FAILURE in 10m 03s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/8d1c2ddf49ee450c8b6782c871563bd2 : FAILURE in 24m 13s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/d260af5f5a024dc7a951e5004f6996c7 : SUCCESS in 22m 35s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/bcbe06914dce4cb69f73f089c510b5d0 : SUCCESS in 14m 11s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/7f43327dece34d3989b56ef12664ce21 : SUCCESS in 34m 05s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/04f07346864741f09188f61d215ce05e : SUCCESS in 30m 57s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/6b8559f600d4408d91c6af7f6186ee24 : SUCCESS in 40m 46s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/5e02fddfdc3b4faf8681d62667e3ca1d : FAILURE in 4m 06s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"f7da8099690143c2771ad0ffc98c65ebba67cb8e","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-09 16:24:18.000000000","message":"Patch Set 2: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":2},{"id":"49134f39b3fb81d9ea290c723e1b3104074417c9","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-09 23:03:15.000000000","message":"Patch Set 2: Verified-2\n\nBuild failed (gate pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\n\nhttps://zuul.opendev.org/t/openstack/buildset/bde402e9ef1d456f8a93aab9779fef70\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/7c43ff7997874da5a7ca6f155f701b36 : SUCCESS in 3m 48s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/9c4805328c2944bcbae3030a32abe380 : SUCCESS in 7m 53s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/a4c93423453b4688aa9b7d55f31651f9 : SUCCESS in 9m 36s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/f7bd6fa9d54347c08189e49a54d33d9a : SUCCESS in 10m 45s\n- grenade https://zuul.opendev.org/t/openstack/build/5a5229eea6114f0a801aecdf0375370e : SUCCESS in 1h 17m 02s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/8b308dffb90a40df91590589f4ec67b2 : SUCCESS in 1h 39m 57s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/7aa7b5f5b4444ca086a13979112e6411 : SUCCESS in 6m 39s\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/873c9df5ea8a484ba53272e14a84abcd : SUCCESS in 17m 10s\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/6ada28e1138a4a0890565e56d5be08a2 : SUCCESS in 13m 42s\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/8813383fbf2347ba8ff585e611435b5e : SUCCESS in 1h 05m 07s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/e255435a64864edf98515e0ee4bc480a : FAILURE in 41m 06s","accounts_in_message":[],"_revision_number":2},{"id":"1fea5e2fcd57ab19166532ebc636a43f349ec775","author":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"date":"2026-06-10 02:54:01.000000000","message":"Patch Set 2:\n\n(1 comment)","accounts_in_message":[],"_revision_number":2},{"id":"84ce1385d992c0f568199c22b5e55e685417e317","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-10 04:11:36.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/6cee8c99d7c84885a138fa825d719cac\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/5a9714f5a3844da29ceb138fd19b3be9 : SUCCESS in 16m 10s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/d85be839610a40ffaf1bd0a865a1d760 : SUCCESS in 6m 55s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/2ea5af609a524f1895323bd30385ea3c : SUCCESS in 13m 25s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/4b5cbc73afaf4ab58a244f5cde440764 : SUCCESS in 12m 19s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/947ef887516c48f8b19453f73f98286e : SUCCESS in 17m 01s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/b3b938f92f47423c931bf387bbe75175 : SUCCESS in 14m 44s\n- grenade https://zuul.opendev.org/t/openstack/build/43564e0243244c878711cf1735cee418 : SUCCESS in 1h 07m 47s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/e12791f3a7b04848bb85cdaf51e07448 : SUCCESS in 59m 49s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/66ce9d61c2854294958cf43c1bf0a023 : SUCCESS in 14m 41s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/a7d30d943c4d4403a1627decda3acae7 : SUCCESS in 8m 42s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/21604cecccf648299b6bd987ad345503 : SUCCESS in 33m 41s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/2d01a5b03fc542bab87d51af180c27ce : FAILURE in 9m 28s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/d1fd2a53bf9c446181d3e16fbf63fc82 : FAILURE in 27m 51s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/1577749e3091424cb7481f38c0338fd2 : SUCCESS in 16m 51s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/333c2686cc904784bfb13c92b050c8dc : SUCCESS in 23m 31s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/dc1ad9bf4a8949c7a50f7f737b4b2d71 : SUCCESS in 23m 26s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/94f504b2dc514e55883f38fd32689d36 : SUCCESS in 50m 48s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/5fae9d7d845143f89b287bda1427fdc4 : SUCCESS in 38m 31s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/f06848633b2245f4a99025817c7e2848 : FAILURE in 7m 54s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"c977bb7b72611c42ab080bcb2a43fa23ceada98a","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-10 04:12:03.000000000","message":"Patch Set 2: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":2},{"id":"0cedb385c0c372b74869d4e9b5ee3c0c986b4c9c","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-10 06:06:26.000000000","message":"Patch Set 2: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/11a0a3bc15d9462695ef9da7d5538320\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/abf4ab056cd943f0a7ca17e19753cf14 : SUCCESS in 4m 03s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/09f4cf8aa058418999ae498c0f789f32 : SUCCESS in 8m 29s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/bf2b6b41bcf2445283b139f421766681 : SUCCESS in 8m 44s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/b12366170e1e46f8816e80f297e0e631 : SUCCESS in 10m 55s\n- grenade https://zuul.opendev.org/t/openstack/build/e4936191f5df41dfa85c42a9915cde20 : SUCCESS in 1h 15m 01s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/7e0d768667e84b5792017f5c5339f3d7 : SUCCESS in 1h 49m 14s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/6b7773108b0a4b948a55aca20763a0bf : SUCCESS in 12m 08s\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/8ba3381919094da98f781c50d6db8dd0 : SUCCESS in 31m 22s\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/84b05b1b0ced44ceb92087fed3bb88b1 : SUCCESS in 14m 31s\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/2ba52a1860ec4cc5907f7336f78cf43f : SUCCESS in 1h 04m 05s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/3acdc4bb9525493ca8ee03a7cae566d5 : SUCCESS in 30m 14s","accounts_in_message":[],"_revision_number":2},{"id":"6ba5668be092d86dd5ee1e27392f22f84aebb02f","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-10 06:06:26.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":2},{"id":"f780d819b5ee9bfcf76c6789f689a7e9d9742613","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-10 06:07:33.000000000","message":"Patch Set 2:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/bc27273a71644d95afcdbc0ad83fca60\n\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/17f56623b0b84e48bdc6a3d6aa58263d : SUCCESS in 55s\n- promote-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/d29093ddf67e4d5384dfaa839ed0f4a9 : SUCCESS in 45s","accounts_in_message":[],"_revision_number":2}],"current_revision_number":2,"current_revision":"a1854ec56241de54484ac0f966ee86f1c035cf54","revisions":{"6ad6f28a537c3613e5051d9a29756fc97949f77d":{"kind":"REWORK","_number":1,"created":"2026-05-28 15:06:15.000000000","uploader":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"ref":"refs/changes/99/990499/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/99/990499/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/99/990499/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/99/990499/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/99/990499/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/99/990499/1"}}},"commit":{"parents":[{"commit":"fac6a5ff9620be2632d02d0003d56dcb9ceae551","subject":"Preserve expires_at when rescoping federated tokens (CVE-2026-44394)","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/fac6a5ff9620be2632d02d0003d56dcb9ceae551"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-05-12 07:10:20.000000000","tz":120},"committer":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2026-05-22 08:18:41.000000000","tz":120},"subject":"Prevent RBAC policy bypass via JSON body and query filters (CVE-2026-42999)","message":"Prevent RBAC policy bypass via JSON body and query filters (CVE-2026-42999)\n\nThe RBAC enforcer unconditionally merged the raw JSON request body into\nthe policy enforcement dictionary after trusted target data had been set\nfrom the database. An attacker could include a \"target\" key in the JSON\nbody to overwrite database-sourced RBAC target attributes, causing all\n%(target.*)s policy substitutions to evaluate against attacker-controlled\nvalues. This affected 88 endpoint/method combinations across all Keystone\nAPI resources.\n\nThe fix namespaces user-controlled JSON body data under a \"request_body\"\nkey in the policy dict, making it structurally impossible for request body\nfields to collide with internal keys like \"target\" or view_args.\n\nThe only in-tree policy rule that depended on the old JSON body merge\nbehavior was identity:create_trust, which referenced\n%(trust.trustor_user_id)s from the request body at the top level of the\npolicy dict. This is updated to use target_attr and the\n%(target.trust.trustor_user_id)s substitution, consistent with all other\ntrust policy rules.\n\nAdditionally, query-string filter values had the same structural issue:\n_extract_filter_values() results were merged at the top level, meaning a\nfilter key matching a view_arg key (e.g. user_id on\n/v3/users/{user_id}/... endpoints using ADMIN_OR_SYSTEM_READER_OR_OWNER)\ncould be overwritten by an attacker-controlled ?user_id\u003d query param,\nbypassing ownership checks. Filter values are now namespaced under\n\"filter_attr\". No in-tree policy rule references filter values via %(key)s\nsubstitutions, so this is backwards-compatible for upstream deployments.\n\nCloses-Bug: #2148398\nAssisted-by: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\nCo-authored-by: Boris Bobrov \u003cb.bobrov@sap.com\u003e\nCo-authored-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\nChange-Id: I295d1ac27faad05a680bb2b3fac8cfa27fa1c4bd\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n(cherry picked from commit 22b51f5d5d86350d3fbc66697e4097bacf2a8ce9)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/6ad6f28a537c3613e5051d9a29756fc97949f77d"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/6ad6f28a537c3613e5051d9a29756fc97949f77d"}]},"branch":"refs/heads/stable/2025.2"},"a1854ec56241de54484ac0f966ee86f1c035cf54":{"kind":"TRIVIAL_REBASE","_number":2,"created":"2026-05-28 21:58:18.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/99/990499/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/99/990499/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/99/990499/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/99/990499/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/99/990499/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/99/990499/2"}}},"commit":{"parents":[{"commit":"98359b2bb57f80e63ed8668c0d6abc37fdc5fbac","subject":"Preserve expires_at when rescoping federated tokens (CVE-2026-44394)","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/98359b2bb57f80e63ed8668c0d6abc37fdc5fbac"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-05-12 07:10:20.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-05-28 21:56:59.000000000","tz":120},"subject":"Prevent RBAC policy bypass via JSON body and query filters (CVE-2026-42999)","message":"Prevent RBAC policy bypass via JSON body and query filters (CVE-2026-42999)\n\nThe RBAC enforcer unconditionally merged the raw JSON request body into\nthe policy enforcement dictionary after trusted target data had been set\nfrom the database. An attacker could include a \"target\" key in the JSON\nbody to overwrite database-sourced RBAC target attributes, causing all\n%(target.*)s policy substitutions to evaluate against attacker-controlled\nvalues. This affected 88 endpoint/method combinations across all Keystone\nAPI resources.\n\nThe fix namespaces user-controlled JSON body data under a \"request_body\"\nkey in the policy dict, making it structurally impossible for request body\nfields to collide with internal keys like \"target\" or view_args.\n\nThe only in-tree policy rule that depended on the old JSON body merge\nbehavior was identity:create_trust, which referenced\n%(trust.trustor_user_id)s from the request body at the top level of the\npolicy dict. This is updated to use target_attr and the\n%(target.trust.trustor_user_id)s substitution, consistent with all other\ntrust policy rules.\n\nAdditionally, query-string filter values had the same structural issue:\n_extract_filter_values() results were merged at the top level, meaning a\nfilter key matching a view_arg key (e.g. user_id on\n/v3/users/{user_id}/... endpoints using ADMIN_OR_SYSTEM_READER_OR_OWNER)\ncould be overwritten by an attacker-controlled ?user_id\u003d query param,\nbypassing ownership checks. Filter values are now namespaced under\n\"filter_attr\". No in-tree policy rule references filter values via %(key)s\nsubstitutions, so this is backwards-compatible for upstream deployments.\n\nCloses-Bug: #2148398\nAssisted-by: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\nCo-authored-by: Boris Bobrov \u003cb.bobrov@sap.com\u003e\nCo-authored-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\nChange-Id: I295d1ac27faad05a680bb2b3fac8cfa27fa1c4bd\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n(cherry picked from commit 22b51f5d5d86350d3fbc66697e4097bacf2a8ce9)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/a1854ec56241de54484ac0f966ee86f1c035cf54"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/a1854ec56241de54484ac0f966ee86f1c035cf54"}]},"branch":"refs/heads/stable/2025.2"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}