)]}'
{"id":"openstack%2Fkeystone~990504","triplet_id":"openstack%2Fkeystone~stable%2F2025.1~I295d1ac27faad05a680bb2b3fac8cfa27fa1c4bd","project":"openstack/keystone","branch":"stable/2025.1","attention_set":{},"removed_from_attention_set":{"17685":{"account":{"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"},"last_update":"2026-06-12 16:07:44.000000000","reason":"Change was submitted"},"14250":{"account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"last_update":"2026-06-12 16:07:44.000000000","reason":"Change was submitted"},"27900":{"account":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"last_update":"2026-06-12 16:07:44.000000000","reason":"Change was submitted"}},"hashtags":["CVE-2026-42999"],"change_id":"I295d1ac27faad05a680bb2b3fac8cfa27fa1c4bd","subject":"Prevent RBAC policy bypass via JSON body and query filters (CVE-2026-42999)","status":"MERGED","created":"2026-05-28 15:06:35.000000000","updated":"2026-06-12 16:13:32.000000000","submitted":"2026-06-12 16:07:44.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":1,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"990504","meta_rev_id":"3e788e6dcd52c8209316b341936514d0fba63d8a","_number":990504,"virtual_id_number":990504,"owner":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-06-12 16:07:44.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"all":[{"value":2,"date":"2026-06-11 10:52:47.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":2,"date":"2026-06-02 15:29:17.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"all":[{"value":1,"date":"2026-06-11 10:52:47.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[{"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"}],"reviewers":{"CC":[{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"}],"REVIEWER":[{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-05-28 15:06:35.000000000","updated_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"reviewer":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"state":"REVIEWER"},{"updated":"2026-05-28 16:48:16.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-06-12 12:14:46.000000000","updated_by":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"reviewer":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"state":"CC"},{"updated":"2026-06-12 12:18:51.000000000","updated_by":{"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"},"reviewer":{"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"},"state":"REVIEWER"}],"messages":[{"id":"28cfd9e225051b81454a2738ff5332c07692189e","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-05-28 15:06:35.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"5079e6119bad62eb0edaeccfbe1a4e056676ef05","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-28 16:48:16.000000000","message":"Patch Set 1: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/d6ccd89cd18c42b7afdbe05986966b1c\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/65807f33f5554030943b8b44206fbe51 : SUCCESS in 18m 55s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/6c2a35197d074f679b68af303cd1136e : FAILURE in 9m 24s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/4856abc15da9409284f91b2d6bb67ca9 : SUCCESS in 12m 26s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/4e825ef28f584f839e02f28e8d534e38 : SUCCESS in 15m 45s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/1a72c592858441afb631c4e681724663 : SUCCESS in 14m 04s\n- grenade https://zuul.opendev.org/t/openstack/build/dad2181238b3472b885334d23069e24c : FAILURE in 19m 15s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/43833588b95f47658c2528f7de39d574 : SUCCESS in 1h 20m 41s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/33cc715a300147489f3a41e844480a56 : SUCCESS in 12m 36s\n- keystone-dsvm-py3-functional https://zuul.opendev.org/t/openstack/build/0c7e37ac4a0049bd924cbf28ca4086dd : SUCCESS in 14m 54s\n- keystone-dsvm-py3-functional-fips https://zuul.opendev.org/t/openstack/build/745a5862f6fc459bb19fd314f9d67e97 : FAILURE in 36m 52s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy https://zuul.opendev.org/t/openstack/build/1dcf02b734524ddbb69b1bc7fd979954 : FAILURE in 27m 06s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy-k2k https://zuul.opendev.org/t/openstack/build/d7a626b546ac4efd84bc0c7da2e84e7f : FAILURE in 12m 52s (non-voting)\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/bb1836d44d1c402d92ff01550f78d986 : SUCCESS in 20m 22s (non-voting)\n- keystone-dsvm-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/63daa0e5d0874cf78d52f09428b3f326 : SUCCESS in 42m 12s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/55e8d910a0534540b1afffcbaccefb71 : SUCCESS in 46m 36s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/dd918c1972ec46a8a2ef967a2cec645b : FAILURE in 6m 59s (non-voting)\n- keystone-dsvm-functional-oidc-federation https://zuul.opendev.org/t/openstack/build/5934769e36fa4bb1a20d40ad812e84ee : FAILURE in 37m 17s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"35cd68e097c4fc4c40dcbbc58590041651fd3bd4","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-05-28 21:58:39.000000000","message":"Uploaded patch set 2: Patch Set 1 was rebased.\n\nOutdated Votes:\n* Verified-1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":2},{"id":"965668d3a42fb819dc495a8ecbf4b6e7f21c1629","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-28 23:14:38.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/97f84a60dd2643a3a0e595a613c676b9\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/d597ddc352454ff3b23ed35839722da6 : SUCCESS in 16m 42s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/ae0647871cd74daf93beb91ceda9188b : SUCCESS in 6m 55s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/3e5c8cc263ab40d2b20cd3c1f30d5eee : SUCCESS in 13m 54s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/8ae9a592e64c4d07821a2c298a5b444c : SUCCESS in 10m 33s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/13936e3152d14ca0a746546b8f0f1f67 : SUCCESS in 15m 34s\n- grenade https://zuul.opendev.org/t/openstack/build/47b79305d4994aa5a8e7d0265935a34e : SUCCESS in 50m 31s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/68ee6d9eb78848d79cf09fdb94b2329c : SUCCESS in 58m 19s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/cabc55f9c3ed432ebbe480095b14d15f : SUCCESS in 6m 53s\n- keystone-dsvm-py3-functional https://zuul.opendev.org/t/openstack/build/f4322c0aaeaf48129722e2bc45157b2c : SUCCESS in 30m 06s\n- keystone-dsvm-py3-functional-fips https://zuul.opendev.org/t/openstack/build/d9691770a5c04b48ae2dbc683eded2c1 : FAILURE in 38m 17s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy https://zuul.opendev.org/t/openstack/build/dbf333100aef46f8841a2c326d8f2d8d : FAILURE in 24m 51s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy-k2k https://zuul.opendev.org/t/openstack/build/24178ebf85b44a34bbb9dc2548c8d69b : FAILURE in 26m 37s (non-voting)\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/e72a497177af4653a3770224c84affaf : SUCCESS in 20m 00s (non-voting)\n- keystone-dsvm-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/1ca4f553db8f42bdb3e02a6fe4e0d12e : SUCCESS in 34m 22s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/a568957153054d2cbd92457672a8dcd7 : SUCCESS in 1h 02m 42s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/42f782ce23d043a98c1e8801204b677d : FAILURE in 7m 08s (non-voting)\n- keystone-dsvm-functional-oidc-federation https://zuul.opendev.org/t/openstack/build/14f6c910de4e4203963cdb9059cb391c : FAILURE in 28m 47s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"f1648938104d7180994295dbbf2692324cc08734","tag":"autogenerated:gerrit:setHashtag","author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"date":"2026-05-29 06:39:18.000000000","message":"Hashtag added: CVE-2026-42999","accounts_in_message":[],"_revision_number":2},{"id":"ee3f13b963b969ce8e522d83a71688f1f6d63992","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-06-02 15:29:17.000000000","message":"Patch Set 2: Code-Review+2","accounts_in_message":[],"_revision_number":2},{"id":"d94aafedb8cb7e390d30c7e57bdfdeb7e6c5b2d1","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-06-11 10:52:47.000000000","message":"Patch Set 2: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":2},{"id":"9a1db2b282e0d1fd891cf705e3233cc199204795","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-11 10:53:38.000000000","message":"Patch Set 2: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":2},{"id":"89fe2d3c864f5e92f0ec850a400515af0c32f316","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-11 11:53:50.000000000","message":"Patch Set 2: Verified-2\n\nThis change depends on a change that failed to merge.\n\nChange https://review.opendev.org/c/openstack/keystone/+/990503 is needed.","accounts_in_message":[],"_revision_number":2},{"id":"7948d0be6901a86db1358a91af5306423f73ba48","author":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"date":"2026-06-12 12:14:46.000000000","message":"Patch Set 2:\n\n(1 comment)","accounts_in_message":[],"_revision_number":2},{"id":"58fd79859c41833fd35ab80c210ee4877661b3cf","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-12 14:10:57.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/4cce420055694d72ac3c54a486c2b6b3\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/7fb6e16b85384b9bbee4fee8280b8030 : SUCCESS in 13m 48s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/85b80d30cb5e4b3fbe6aeb469644146b : SUCCESS in 6m 52s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/2ba5001aa14742daa91fd4cc8c0e8a1f : SUCCESS in 12m 19s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/1578f2842ac8461bb6ebdbf8c16680c8 : SUCCESS in 13m 01s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/5515dc30df67442d92ca88c34742062a : SUCCESS in 14m 03s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/8149155f85854a4cb0f28d1f5608fba7 : SUCCESS in 7m 32s\n- keystone-dsvm-py3-functional https://zuul.opendev.org/t/openstack/build/22d0b6e70e9f48dbbec362d7c6a28ae9 : SUCCESS in 30m 41s\n- keystone-dsvm-py3-functional-fips https://zuul.opendev.org/t/openstack/build/68ae144d1c03470a97fcddd258dd160e : FAILURE in 25m 01s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy https://zuul.opendev.org/t/openstack/build/c977bc2dddca4bed927d65757bfd4cef : FAILURE in 17m 58s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy-k2k https://zuul.opendev.org/t/openstack/build/1570603ca33241ff80fa0c58a2788f5f : SUCCESS in 20m 07s (non-voting)\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/241e12eb225b4fc9b763aa035013bca4 : FAILURE in 18m 49s (non-voting)\n- keystone-dsvm-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/ae41d6867ea347a795af7bc3616076b9 : SUCCESS in 26m 03s (non-voting)\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/deb72b6e6abe416589d3acc9c8d9c1c9 : SUCCESS in 1h 47m 45s\n- grenade https://zuul.opendev.org/t/openstack/build/a55d078a37204db6bfebfe17f35aeea9 : FAILURE in 51m 13s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/62dbfba2c6de455ba0cd04a3dd02b272 : SUCCESS in 58m 43s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/abd82789fd604e3489bcfb2feb4c31d3 : FAILURE in 6m 11s (non-voting)\n- keystone-dsvm-functional-oidc-federation https://zuul.opendev.org/t/openstack/build/01a0e17580274f35a80c58ae4ae1a2d5 : SUCCESS in 22m 29s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"b389d56007c63ccb98d9099862bffb6edba4bb5a","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-12 14:11:43.000000000","message":"Patch Set 2: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":2},{"id":"9d8a98dbbb820a922ab40e2e1e24e2f11d4929e6","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-12 16:07:44.000000000","message":"Patch Set 2: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/a908912c392043caac9bf0a52cf2416e\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/fa9c07b7a70c450eb5ccc3695310608d : SUCCESS in 7m 34s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/02a8e135d2d5418eaad38e00fe7bad01 : SUCCESS in 12m 11s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/e848ccb19dc9434b854aa1bbba3f9cb8 : SUCCESS in 14m 23s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/e149a552fe69434cade6e4d28ba2a06e : SUCCESS in 15m 41s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/35afdb52aa93496396eff11fcb91b5f9 : SUCCESS in 7m 07s\n- keystone-dsvm-py3-functional https://zuul.opendev.org/t/openstack/build/a2c907514d4549e59cae205843145858 : SUCCESS in 21m 40s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/f54b20787c2b4a17ba47032c9fb2c7d9 : SUCCESS in 1h 03m 38s\n- grenade https://zuul.opendev.org/t/openstack/build/167fdd2ee91841d9b5a1ec885c7c1c45 : FAILURE in 50m 34s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/5cc54e6fa0be4408aec6332a19e55395 : SUCCESS in 48m 04s","accounts_in_message":[],"_revision_number":2},{"id":"07d65bc1cfec6b85a0bb51082028999410853370","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-12 16:07:44.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":2},{"id":"3e788e6dcd52c8209316b341936514d0fba63d8a","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-12 16:13:32.000000000","message":"Patch Set 2:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/b08c81267d7941239285197ae21ad694\n\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/9a285ddde5584e65a095900e9e1ab3ae : SUCCESS in 1m 11s\n- promote-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/bcdab04886c94eb69e30326f0be0fc74 : SUCCESS in 45s","accounts_in_message":[],"_revision_number":2}],"current_revision_number":2,"current_revision":"2743acbcbac8190ae24f3c3e85149dc68b7f2254","revisions":{"0895acfab2c3fa98253795844c3e2f9810950a65":{"kind":"REWORK","_number":1,"created":"2026-05-28 15:06:35.000000000","uploader":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"ref":"refs/changes/04/990504/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/04/990504/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/04/990504/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/04/990504/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/04/990504/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/04/990504/1"}}},"commit":{"parents":[{"commit":"02666f7006708b4b43042519212cf702f4f28588","subject":"Preserve expires_at when rescoping federated tokens (CVE-2026-44394)","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/02666f7006708b4b43042519212cf702f4f28588"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-05-12 07:10:20.000000000","tz":120},"committer":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2026-05-22 08:23:07.000000000","tz":120},"subject":"Prevent RBAC policy bypass via JSON body and query filters (CVE-2026-42999)","message":"Prevent RBAC policy bypass via JSON body and query filters (CVE-2026-42999)\n\nThe RBAC enforcer unconditionally merged the raw JSON request body into\nthe policy enforcement dictionary after trusted target data had been set\nfrom the database. An attacker could include a \"target\" key in the JSON\nbody to overwrite database-sourced RBAC target attributes, causing all\n%(target.*)s policy substitutions to evaluate against attacker-controlled\nvalues. This affected 88 endpoint/method combinations across all Keystone\nAPI resources.\n\nThe fix namespaces user-controlled JSON body data under a \"request_body\"\nkey in the policy dict, making it structurally impossible for request body\nfields to collide with internal keys like \"target\" or view_args.\n\nThe only in-tree policy rule that depended on the old JSON body merge\nbehavior was identity:create_trust, which referenced\n%(trust.trustor_user_id)s from the request body at the top level of the\npolicy dict. This is updated to use target_attr and the\n%(target.trust.trustor_user_id)s substitution, consistent with all other\ntrust policy rules.\n\nAdditionally, query-string filter values had the same structural issue:\n_extract_filter_values() results were merged at the top level, meaning a\nfilter key matching a view_arg key (e.g. user_id on\n/v3/users/{user_id}/... endpoints using ADMIN_OR_SYSTEM_READER_OR_OWNER)\ncould be overwritten by an attacker-controlled ?user_id\u003d query param,\nbypassing ownership checks. Filter values are now namespaced under\n\"filter_attr\". No in-tree policy rule references filter values via %(key)s\nsubstitutions, so this is backwards-compatible for upstream deployments.\n\nCloses-Bug: #2148398\nAssisted-by: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\nCo-authored-by: Boris Bobrov \u003cb.bobrov@sap.com\u003e\nCo-authored-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\nChange-Id: I295d1ac27faad05a680bb2b3fac8cfa27fa1c4bd\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n(cherry picked from commit 22b51f5d5d86350d3fbc66697e4097bacf2a8ce9)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/0895acfab2c3fa98253795844c3e2f9810950a65"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/0895acfab2c3fa98253795844c3e2f9810950a65"}]},"branch":"refs/heads/stable/2025.1"},"2743acbcbac8190ae24f3c3e85149dc68b7f2254":{"kind":"TRIVIAL_REBASE","_number":2,"created":"2026-05-28 21:58:39.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/04/990504/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/04/990504/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/04/990504/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/04/990504/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/04/990504/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/04/990504/2"}}},"commit":{"parents":[{"commit":"7846c2375f72e1f5ad2f797241d3e6ca2e09d8b1","subject":"Preserve expires_at when rescoping federated tokens (CVE-2026-44394)","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/7846c2375f72e1f5ad2f797241d3e6ca2e09d8b1"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-05-12 07:10:20.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-05-28 21:57:05.000000000","tz":120},"subject":"Prevent RBAC policy bypass via JSON body and query filters (CVE-2026-42999)","message":"Prevent RBAC policy bypass via JSON body and query filters (CVE-2026-42999)\n\nThe RBAC enforcer unconditionally merged the raw JSON request body into\nthe policy enforcement dictionary after trusted target data had been set\nfrom the database. An attacker could include a \"target\" key in the JSON\nbody to overwrite database-sourced RBAC target attributes, causing all\n%(target.*)s policy substitutions to evaluate against attacker-controlled\nvalues. This affected 88 endpoint/method combinations across all Keystone\nAPI resources.\n\nThe fix namespaces user-controlled JSON body data under a \"request_body\"\nkey in the policy dict, making it structurally impossible for request body\nfields to collide with internal keys like \"target\" or view_args.\n\nThe only in-tree policy rule that depended on the old JSON body merge\nbehavior was identity:create_trust, which referenced\n%(trust.trustor_user_id)s from the request body at the top level of the\npolicy dict. This is updated to use target_attr and the\n%(target.trust.trustor_user_id)s substitution, consistent with all other\ntrust policy rules.\n\nAdditionally, query-string filter values had the same structural issue:\n_extract_filter_values() results were merged at the top level, meaning a\nfilter key matching a view_arg key (e.g. user_id on\n/v3/users/{user_id}/... endpoints using ADMIN_OR_SYSTEM_READER_OR_OWNER)\ncould be overwritten by an attacker-controlled ?user_id\u003d query param,\nbypassing ownership checks. Filter values are now namespaced under\n\"filter_attr\". No in-tree policy rule references filter values via %(key)s\nsubstitutions, so this is backwards-compatible for upstream deployments.\n\nCloses-Bug: #2148398\nAssisted-by: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\nCo-authored-by: Boris Bobrov \u003cb.bobrov@sap.com\u003e\nCo-authored-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\nChange-Id: I295d1ac27faad05a680bb2b3fac8cfa27fa1c4bd\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n(cherry picked from commit 22b51f5d5d86350d3fbc66697e4097bacf2a8ce9)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/2743acbcbac8190ae24f3c3e85149dc68b7f2254"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/2743acbcbac8190ae24f3c3e85149dc68b7f2254"}]},"branch":"refs/heads/stable/2025.1"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}