An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone RBAC policy enforcer in enforce_call unconditionally merges the raw JSON request body into the policy enforcement dictionary via policy_dict.update(json_input.copy()), overwriting trusted target data that was previously set from database lookups. Because flask.request.get_json is called with force=True, this works regardless of Content-Type or HTTP method. Any authenticated user can inject arbitrary policy target attributes (e.g., user_id, project_id) into the request body to bypass RBAC checks and perform unauthorized operations on resources belonging to other users or projects. This was introduced in commit 5ea59f52 (Rocky/14.0.0).

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8433-1 advisory.

    It was discovered that OpenStack Keystone allowed restricted application credentials to create EC2     credentials. An authenticated attacker with only a reader role could possibly use this issue to bypass the     role restrictions imposed on the application credential. (CVE-2026-33551)

    It was discovered that the OpenStack Keystone LDAP identity backend did not correctly convert the user     enabled attribute to a boolean value. An attacker could possibly use this issue to authenticate as a user     disabled in LDAP. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 25.10.
    (CVE-2026-40683)

    It was discovered that OpenStack Keystone's application credential authentication plugin did not verify     that the user supplied in an authentication request matched the credential owner. An authenticated     attacker could possibly impersonate another user and gain access to their tokens and credentials.
    (CVE-2026-42998)

    It was discovered that OpenStack Keystone's RBAC policy enforcer unconditionally merged the raw JSON     request body into the policy enforcement dictionary, overwriting trusted target data. An authenticated     attacker could possibly use this issue to inject arbitrary policy attributes to bypass RBAC checks.
    (CVE-2026-42999)

    It was discovered that OpenStack Keystone allowed an attacker with the member role to escalate privileges     to admin by chaining application credential impersonation with Keystone trusts. An attacker could possibly     use this issue to create a persistent trust delegating the victim's admin role to themselves.
    (CVE-2026-43000)

    It was discovered that OpenStack Keystone did not validate that the project_id for an EC2 credential     matched the project of the authenticating application credential. An attacker with valid credentials for     one project could possibly use this issue to create EC2 credentials targeting a different project.
    (CVE-2026-43001)

    It was discovered that OpenStack Keystone's federated token rescoping mechanism did not propagate the     original token's expiry to the newly issued token. A remote attacker could possibly use this issue to     maintain access indefinitely by repeatedly rescoping tokens before expiry. (CVE-2026-44394)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 / 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6331 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6331-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     June 08, 2026                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : keystone     CVE ID         : CVE-2026-42998 CVE-2026-42999 CVE-2026-43000                      CVE-2026-43001 CVE-2026-44394

    Multiple vulnerabilities were discovered in Keystone, the OpenStack     identity service, which may result in authorisation bypass, privilege     escalation, user impersonation or incomplete termination of access     privileges.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 2:22.0.2-0+deb12u3. This update also include two fixes     already uploaded to be included in the final Bookworm point release     (CVE-2026-40683, CVE-2026-33551).

    For the stable distribution (trixie), these problems have been fixed in     version 2:27.0.0-3+deb13u4. This update also include two fixes     already uploaded to be included in the next Trixie point release     (CVE-2026-40683, CVE-2026-33551).

    We recommend that you upgrade your keystone packages.

    For the detailed security status of keystone please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/keystone

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4611 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4611-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/               Santiago Ruano Rincn     May 31, 2026                                  https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : keystone     Version        : 2:18.1.0-1+deb11u3     CVE ID         : CVE-2026-33551 CVE-2026-40683 CVE-2026-42998 CVE-2026-42999                      CVE-2026-43000 CVE-2026-43001 CVE-2026-44394     Debian Bug     : 1133118 1133884 1135645

    Multiple vulnerabilities have been found in Keystone, the OpenStack identity     service, including privilege escalation and authorization and access     control flaws.

    CVE-2026-33551

        An authenticated user with only a reader role may obtain an EC2/S3         credential that carries the full set of the parent user's S3         permissions, bypassing the role restrictions imposed on the         application credential. Only deployments that use restricted application         credentials in combination with the EC2/S3 compatibility API         (swift3/s3api) are affected.  Reported by Maxence Bornecque, from         Orange Cyberdefense CERT Vulnerability Intelligence Watch Team.

    CVE-2026-40683

        LDAP identity backend does not convert enabled attribute to boolean. When         the user_enabled_invert configuration option was False (the default),         Keystone did not correctly interpret the LDAP enabled attribute, causing         users disabled in LDAP to be treated as enabled and allowed to         authenticate. Deployments using the LDAP identity backend without         user_enabled_invert=True or user_enabled_emulation are affected.
        Independently reported by Benedikt Trefzer and Andrew Bogott.

    CVE-2026-42998

        Application credential authentication does not verify the caller owns         the credential, allowing user impersonation within a shared project.
        Reported by Boris Bobrov, from SAP SE.

    CVE-2026-42999

        An attacker can inject RBAC policy targets via the JSON request body,         bypassing authorization on any policy-protected endpoint.  Allows         reading all credential secrets, creating credentials for arbitrary         users, and granting admin across domains. Reported by Boris Bobrov,         from SAP SE.

    CVE-2026-43000

        The impersonation from CVE-2026-42998 can be chained with trusts to         escalate from member to admin. The resulting trust persists         independently of the original credential. Reported by Boris Bobrov, from         SAP SE.

    CVE-2026-43001

        Application credentials scoped to one project can create EC2         credentials for a different project. Reported by Tim Shepherd,         roiai.ca.

    CVE-2026-44394

        Federated users can maintain access indefinitely by repeatedly         re-scoping tokens before expiry. Each re-scope issues a fresh full-TTL         token instead of inheriting the original expiry. Only SAML2/OIDC         deployments are affected. Reported by Erichen, Institute of Computing         Technology, Chinese Academy of Sciences.

    For Debian 11 bullseye, these problems have been fixed in version     2:18.1.0-1+deb11u3.

    We recommend that you upgrade your keystone packages.

    For the detailed security status of keystone please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/keystone

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone RBAC policy enforcer in     enforce_call unconditionally merges the raw JSON request body into the policy enforcement dictionary via     policy_dict.update(json_input.copy()), overwriting trusted target data that was previously set from     database lookups. Because flask.request.get_json is called with force=True, this works regardless of     Content-Type or HTTP method. Any authenticated user can inject arbitrary policy target attributes (e.g.,     user_id, project_id) into the request body to bypass RBAC checks and perform unauthorized operations on     resources belonging to other users or projects. This was introduced in commit 5ea59f52 (Rocky/14.0.0).
    (CVE-2026-42999)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
321365	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : OpenStack Keystone vulnerabilities (USN-8433-1)	Nessus	Ubuntu Local Security Checks	high
319887	Debian dsa-6331 : keystone - security update	Nessus	Debian Local Security Checks	high
318131	Debian dla-4611 : keystone - security update	Nessus	Debian Local Security Checks	high
317599	Linux Distros Unpatched Vulnerability : CVE-2026-42999	Nessus	Misc.	high

Detections

Analytics

CVE-2026-42999

high

Tenable Plugins

high

high

high

high