CVE-2026-42999 is an incorrect authorization vulnerability in OpenStack Keystone's RBAC policy enforcement mechanism introduced in version 14.0.0. The vulnerability occurs because the policy enforcer unconditionally updates its policy dictionary with raw JSON input from requests, overwriting trusted target data retrieved from the database. Since flask.request.get_json is called with force=True, this behavior applies regardless of the request's content type or HTTP method. Consequently, authenticated users can inject arbitrary attributes like user_id and project_id into requests to bypass RBAC controls and access or modify resources they should not be authorized to handle.

The vulnerability allows authenticated users to bypass role-based access control policies and perform unauthorized operations on other users' or projects' resources. This can lead to unauthorized data access, modification, or other actions within the OpenStack Keystone service. The CVSS 3.1 base score is 6.0 (medium severity), reflecting network attack vector, high attack complexity, low privileges required, no user interaction, and partial impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, restrict access to Keystone to trusted users only and monitor for suspicious activity. Avoid exposing Keystone APIs to untrusted networks. Follow vendor advisories closely for updates on remediation.