)]}'
{"id":"openstack%2Fkeystone~990501","triplet_id":"openstack%2Fkeystone~stable%2F2025.1~I2fe6089886eebf3775930451b87771e40b5e179e","project":"openstack/keystone","branch":"stable/2025.1","attention_set":{},"removed_from_attention_set":{"14250":{"account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"last_update":"2026-06-12 16:06:47.000000000","reason":"Change was submitted"},"27900":{"account":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"last_update":"2026-06-12 16:06:47.000000000","reason":"Change was submitted"}},"hashtags":["CVE-2026-42998"],"change_id":"I2fe6089886eebf3775930451b87771e40b5e179e","subject":"Fix user impersonation through application credentials (CVE-2026-42998)","status":"MERGED","created":"2026-05-28 15:06:35.000000000","updated":"2026-06-12 16:11:46.000000000","submitted":"2026-06-12 16:06:47.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":1,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"990501","meta_rev_id":"de123f72b3c0329eacb102e1c34fbac20cd00e4d","_number":990501,"virtual_id_number":990501,"owner":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-06-12 16:06:47.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"all":[{"value":2,"date":"2026-06-11 10:52:30.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":2,"date":"2026-06-02 15:23:44.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"all":[{"value":1,"date":"2026-06-11 10:52:30.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}],"CC":[{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-05-28 15:06:35.000000000","updated_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"reviewer":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"state":"REVIEWER"},{"updated":"2026-05-28 17:18:24.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-06-12 12:14:20.000000000","updated_by":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"reviewer":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"state":"CC"}],"messages":[{"id":"c7dcda6753c845f591123ce73dfb44ad5c639413","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-05-28 15:06:35.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"0f6e7ae3f9abb8d73be02603f305bd32494edc79","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-28 17:18:24.000000000","message":"Patch Set 1: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/a991aee76b42427f9d0cb42213be244c\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/67e8cf19dc1a426bb3db4115c8292469 : SUCCESS in 17m 42s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/74d64dd946304f5eb9bcbd80f2efafbd : FAILURE in 7m 23s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/25043665bc7d4baea4215a059b47f9f3 : SUCCESS in 13m 24s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/a0fd99c49bc74a9889a1fde72f3a7a1e : SUCCESS in 15m 45s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/4d05b3b940114bb1816563c69556a8ce : SUCCESS in 15m 52s\n- grenade https://zuul.opendev.org/t/openstack/build/d9733eda0cde4f9bb89c37d5e234ead6 : FAILURE in 31m 25s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/b4bef20766a74681bb44d3869974c190 : SUCCESS in 1h 53m 57s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/49366e7a3a414c15b9c667fa69e0cc8f : SUCCESS in 13m 25s\n- keystone-dsvm-py3-functional https://zuul.opendev.org/t/openstack/build/958c3f904e374514a73474c405efeac6 : SUCCESS in 32m 40s\n- keystone-dsvm-py3-functional-fips https://zuul.opendev.org/t/openstack/build/e773734514d14a89b3335083ffe17fa3 : FAILURE in 38m 00s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy https://zuul.opendev.org/t/openstack/build/324558dcaf09489099fdc5af9de81bad : FAILURE in 25m 28s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy-k2k https://zuul.opendev.org/t/openstack/build/d004198a05d840aab5c235409f7cd59e : FAILURE in 31m 02s (non-voting)\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/1313dc4c66a1470ea471007661943a4e : SUCCESS in 19m 26s (non-voting)\n- keystone-dsvm-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/a6a2e8f8543d4d699f048b81288b198e : SUCCESS in 39m 13s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/68703809ca6b4645b6db4b944f064bfe : SUCCESS in 57m 55s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/6ddf8471b0fa429088451097a651023c : FAILURE in 4m 57s (non-voting)\n- keystone-dsvm-functional-oidc-federation https://zuul.opendev.org/t/openstack/build/dcc5a067886f4e7d8c2a6693c0ade6d9 : FAILURE in 21m 35s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"73f0659da39ee8fff772c17976b693762825e1d3","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-05-28 21:58:30.000000000","message":"Uploaded patch set 2: Patch Set 1 was rebased.\n\nOutdated Votes:\n* Verified-1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":2},{"id":"977687f2670af27e5a0ce97175d3d02ad3577ebe","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-28 23:47:05.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/a2b1c573dfc344be90fa7bf88f491eaf\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/7e215756310e4f04bf75e8840ff2b5f3 : SUCCESS in 18m 19s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/30211e3330f24467abf4799a2797c8f9 : SUCCESS in 4m 01s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/64f8411cb21241acbbdacf12f924a00f : SUCCESS in 15m 50s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/9ece74197ba049d898d7f6dba7580713 : SUCCESS in 13m 14s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/f21dbdc6a8194eeda1c7aafc1607419f : SUCCESS in 6m 38s\n- grenade https://zuul.opendev.org/t/openstack/build/af024ddb9851402e8deac9a62655987a : SUCCESS in 35m 35s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/3b98fb47092f4e4394e10173e340d5d3 : SUCCESS in 1h 43m 47s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/6bbb6eef59224d73a131c0b45ae46e3e : SUCCESS in 15m 26s\n- keystone-dsvm-py3-functional https://zuul.opendev.org/t/openstack/build/357b6d11ef0c4983b70e6364a3ce1343 : SUCCESS in 32m 56s\n- keystone-dsvm-py3-functional-fips https://zuul.opendev.org/t/openstack/build/8698dd67a89443488c49ca9b7cc656fa : FAILURE in 40m 11s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy https://zuul.opendev.org/t/openstack/build/defcef64cf4345e1b71600ed9f14aa2c : FAILURE in 25m 39s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy-k2k https://zuul.opendev.org/t/openstack/build/821c325d063a4256b64c03039f1bf2e2 : FAILURE in 28m 14s (non-voting)\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/ca81d0b8a201425d8548e21938f01d80 : SUCCESS in 14m 31s (non-voting)\n- keystone-dsvm-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/b461bc6477444684b316b1eef0268ac0 : SUCCESS in 22m 04s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/040e04c471e243a0a3aab1d7161c10a3 : SUCCESS in 1h 02m 49s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/43dec2f9d06e4c8b99eea310ed0e7f10 : FAILURE in 4m 44s (non-voting)\n- keystone-dsvm-functional-oidc-federation https://zuul.opendev.org/t/openstack/build/05de5199f44e4b8087201ccdf21f4ca1 : FAILURE in 26m 40s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"a5c9b2663db3b915b7adebc0f46de56a3f1ec185","tag":"autogenerated:gerrit:setHashtag","author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"date":"2026-05-29 06:39:11.000000000","message":"Hashtag added: CVE-2026-42998","accounts_in_message":[],"_revision_number":2},{"id":"bf24cea90420e2c22f9c378ab6eb08829bc4d555","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-06-02 15:23:44.000000000","message":"Patch Set 2: Code-Review+2","accounts_in_message":[],"_revision_number":2},{"id":"73de6467eeb417109d89e8f27254da55866938c1","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-06-11 10:52:30.000000000","message":"Patch Set 2: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":2},{"id":"5a7a6664cfbed6ad914884c27b79f247838a179e","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-11 10:53:32.000000000","message":"Patch Set 2: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":2},{"id":"d53bb8904fb11e649a892df7ff5fbc3142f6a00c","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-11 11:53:49.000000000","message":"Patch Set 2: Verified-2\n\nThis change depends on a change that failed to merge.\n\nChange https://review.opendev.org/c/openstack/keystone/+/990500 is needed.","accounts_in_message":[],"_revision_number":2},{"id":"e3517a4d1aaaf5f5423aa8321f0274dce2030895","author":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"date":"2026-06-12 12:14:20.000000000","message":"Patch Set 2:\n\n(1 comment)","accounts_in_message":[],"_revision_number":2},{"id":"ce031d403d70abaeef2fdc18be0aa80febc19c7f","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-12 14:09:39.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/6d33b497beb34c6c8b9a7731b28b42f2\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/ee416bd12bcb4b79ab793f1aa9887f03 : SUCCESS in 14m 11s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/c74cd74996114f7cbc63c2ecde560d0e : SUCCESS in 6m 45s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/71f578edaf094e759e388af4e6dfa146 : SUCCESS in 12m 42s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/4ee25ca0163947a6a891219ac855c744 : SUCCESS in 10m 24s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/32cafe55f4174acf8f12320d11145ac2 : SUCCESS in 14m 11s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/28c31647f7c24fe6a1886ca7ebb40a1b : SUCCESS in 7m 26s\n- keystone-dsvm-py3-functional https://zuul.opendev.org/t/openstack/build/69f8772c959c4e83932797fa397c4191 : SUCCESS in 30m 29s\n- keystone-dsvm-py3-functional-fips https://zuul.opendev.org/t/openstack/build/8c7cad2f12934461b181adff9706df70 : FAILURE in 20m 02s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy https://zuul.opendev.org/t/openstack/build/8884746949494233b383a6499cd28f4a : FAILURE in 33m 58s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy-k2k https://zuul.opendev.org/t/openstack/build/d61254fd0a4a47a788a4d05ed3c31eec : SUCCESS in 28m 18s (non-voting)\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/1c4dc34b2e2d46c5903bbecb38c84b6c : SUCCESS in 20m 13s (non-voting)\n- keystone-dsvm-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/bdc50ad6fe904e71be30f9748464017c : SUCCESS in 27m 03s (non-voting)\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/dca16267ac224f0bb11c2dcf9ca05eb2 : SUCCESS in 1h 47m 22s\n- grenade https://zuul.opendev.org/t/openstack/build/23ff384d036d4ee9bc0d7bdf7aa04519 : FAILURE in 57m 55s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/730599384067402c814c77a17a447f35 : SUCCESS in 58m 06s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/b2bfce332c0c4637aec128eee52ba2ec : FAILURE in 6m 13s (non-voting)\n- keystone-dsvm-functional-oidc-federation https://zuul.opendev.org/t/openstack/build/9178e5791a3b4a7583d8e99d990d4ac3 : SUCCESS in 31m 06s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"b9a5e434d8c9db148df4c18d3351417fe4885477","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-12 14:10:30.000000000","message":"Patch Set 2: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":2},{"id":"dc6589c89b82b0ac7638a3d695619aab6caef692","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-12 16:06:47.000000000","message":"Patch Set 2: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/8e8645d66cac424aa44e25aac1868888\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/7db6a42d45274227bad3a06c45681385 : SUCCESS in 4m 20s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/14f95656b10d48debccb63f5cefa4b73 : SUCCESS in 13m 25s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/fbd255f51b33452895a607508c75bf42 : SUCCESS in 13m 37s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/f9978a4c0f694804850d19538b35863d : SUCCESS in 8m 11s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/d2776a0ee92b43c7aaffc739dd32515e : SUCCESS in 7m 20s\n- keystone-dsvm-py3-functional https://zuul.opendev.org/t/openstack/build/0c9eb48b6942491eaff35c402d85ab10 : SUCCESS in 31m 38s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/cdb5acea0e3743a0a59bdcf38d2ea044 : SUCCESS in 50m 30s\n- grenade https://zuul.opendev.org/t/openstack/build/ca81070f10a14778b5e07ecf04e1b440 : FAILURE in 54m 35s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/9d55325cad1b47d09ff52e7f8bdec98b : SUCCESS in 42m 28s","accounts_in_message":[],"_revision_number":2},{"id":"6751fb587aa0108137c3a244a1831add535324ec","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-12 16:06:47.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":2},{"id":"de123f72b3c0329eacb102e1c34fbac20cd00e4d","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-12 16:11:46.000000000","message":"Patch Set 2:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/296fc91ee5cd4dc386a1d3590aeada97\n\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/23f2eff3c7e34f1c8965abf42b280c66 : SUCCESS in 1m 06s","accounts_in_message":[],"_revision_number":2}],"current_revision_number":2,"current_revision":"90fe79c82e9eb16547e3e4aa69f9f8cb8daa8bc6","revisions":{"0eaf4ea5e4cedb30a776e845391112bf098a19ad":{"kind":"REWORK","_number":1,"created":"2026-05-28 15:06:35.000000000","uploader":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"ref":"refs/changes/01/990501/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/01/990501/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/01/990501/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/01/990501/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/01/990501/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/01/990501/1"}}},"commit":{"parents":[{"commit":"5c6287679b6499d189bac275daaad5346a54e276","subject":"Enforce delegation project boundary for delegated tokens","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/5c6287679b6499d189bac275daaad5346a54e276"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-05-12 07:22:34.000000000","tz":120},"committer":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2026-05-22 08:23:07.000000000","tz":120},"subject":"Fix user impersonation through application credentials (CVE-2026-42998)","message":"Fix user impersonation through application credentials (CVE-2026-42998)\n\nWhen authenticating by application credential ID, the caller can supply a\n\u0027user\u0027 field in the payload. AppCredInfo conditionally set the user from\nthe credential owner only when no user field was present. If present,\nBaseUserInfo resolved the caller-supplied user and attributed the resulting\ntoken to that user instead of the credential owner.\n\nFix: always set auth_payload[\u0027user\u0027] from the credential\u0027s stored user_id,\nignoring any caller-supplied value.\n\nCloses-Bug: #2148477\nAssisted-by: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\nCo-authored-by: Boris Bobrov \u003cb.bobrov@sap.com\u003e\nChange-Id: I2fe6089886eebf3775930451b87771e40b5e179e\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\nSigned-off-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\n(cherry picked from commit 6cd25fecdab8b9261e916ee10f3dba5aeb0c1984)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/0eaf4ea5e4cedb30a776e845391112bf098a19ad"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/0eaf4ea5e4cedb30a776e845391112bf098a19ad"}]},"branch":"refs/heads/stable/2025.1"},"90fe79c82e9eb16547e3e4aa69f9f8cb8daa8bc6":{"kind":"TRIVIAL_REBASE","_number":2,"created":"2026-05-28 21:58:30.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/01/990501/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/01/990501/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/01/990501/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/01/990501/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/01/990501/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/01/990501/2"}}},"commit":{"parents":[{"commit":"1b27d289f213dcbc9cfa1665cc0433e2fbf15dfa","subject":"Enforce delegation project boundary for delegated tokens","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/1b27d289f213dcbc9cfa1665cc0433e2fbf15dfa"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-05-12 07:22:34.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-05-28 21:57:05.000000000","tz":120},"subject":"Fix user impersonation through application credentials (CVE-2026-42998)","message":"Fix user impersonation through application credentials (CVE-2026-42998)\n\nWhen authenticating by application credential ID, the caller can supply a\n\u0027user\u0027 field in the payload. AppCredInfo conditionally set the user from\nthe credential owner only when no user field was present. If present,\nBaseUserInfo resolved the caller-supplied user and attributed the resulting\ntoken to that user instead of the credential owner.\n\nFix: always set auth_payload[\u0027user\u0027] from the credential\u0027s stored user_id,\nignoring any caller-supplied value.\n\nCloses-Bug: #2148477\nAssisted-by: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\nCo-authored-by: Boris Bobrov \u003cb.bobrov@sap.com\u003e\nChange-Id: I2fe6089886eebf3775930451b87771e40b5e179e\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\nSigned-off-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\n(cherry picked from commit 6cd25fecdab8b9261e916ee10f3dba5aeb0c1984)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/90fe79c82e9eb16547e3e4aa69f9f8cb8daa8bc6"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/90fe79c82e9eb16547e3e4aa69f9f8cb8daa8bc6"}]},"branch":"refs/heads/stable/2025.1"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}