Is CVE-2026-42998 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42998 being exploited in the wild.

How severe is CVE-2026-42998?

Medium severity, with a CVSS score of 6, published 28 May 2026.

Which products and versions are affected?

keystone (PyPI) ECOSYSTEM:introduced=14.0.0,fixed=27.0.2, ECOSYSTEM:introduced=14.0.0,fixed=27.0.2,introduced=28.0.0,fixed=28.0.2,introduced=29.0.0,fixed=29.0.2.

Is there a fix for CVE-2026-42998?

Yes. keystone (PyPI): upgrade to 27.0.2, 29.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-42998 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-42998?

Check whether you run keystone (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42998: OpenStack Keystone User Impersonation in Application Credentials

CVE-2026-42998 · Severity: medium · CVSS 6 · Published 2026-05-28

OpenStack Keystone, the identity service for OpenStack cloud environments, contains a flaw in how it handles application credentials. An authenticated user can trick the system into issuing a security token that belongs to a different user within the same project. This allows an attacker to impersonate colleagues, evade audit logs, and potentially escalate their privileges to administrative levels, gaining unauthorized control over shared cloud resources.

Technologies: keystone (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-42998 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42998 being exploited in the wild.
How severe is CVE-2026-42998?: Medium severity, with a CVSS score of 6, published 28 May 2026.
Which products and versions are affected?: keystone (PyPI) ECOSYSTEM:introduced=14.0.0,fixed=27.0.2, ECOSYSTEM:introduced=14.0.0,fixed=27.0.2,introduced=28.0.0,fixed=28.0.2,introduced=29.0.0,fixed=29.0.2.
Is there a fix for CVE-2026-42998?: Yes. keystone (PyPI): upgrade to 27.0.2, 29.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42998 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-42998?: Check whether you run keystone (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

keystone (PyPI): upgrade to 27.0.2, 29.0.2 or later
```
pip install "keystone>=29.0.2"
```

Technical details

An authorization bypass exists in the Keystone application credential authentication plugin. The 'POST /v3/auth/tokens' endpoint does not verify that the user specified in the authentication payload matches the actual owner of the application credential ID and secret provided. An authenticated attacker can provide their own valid application credential but specify a victim's username and domain in the request body. Keystone then issues a project-scoped token attributed to the victim. This impersonated token can be further abused to create trusts, enabling the attacker to escalate privileges (e.g., from member to admin) if the victim has higher roles. The issue is patched in versions 27.0.2, 28.0.2, and 29.0.2.

Affected products

OpenStack Keystone >= 14.0.0, < 27.0.2; >= 28.0.0, < 28.0.2; >= 29.0.0, < 29.0.2

Identifiers

CVE-2026-42998
GHSA-8f8m-wrvr-wcvf
PYSEC-2026-599

Timeline

2026-04-15: disclosed: Bug reported to OpenStack Launchpad
2026-05-28: advisory: OSSA-2026-015 published
2026-05-28: patched: Fixes released in multiple branches

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.