openstack/keystone — Week of 2026-06-06

Security fixes. The week is dominated by a coordinated batch of CVE remediations, with most changes landing as master/backport pairs. A new enforcement of the delegation project boundary for delegated tokens is the largest piece at roughly 1,000 lines (990490). Alongside it: RBAC policy bypass via JSON body and query filters is closed off (CVE-2026-42999), trust operations are forbidden when acting through application credentials (CVE-2026-43000), expires_at is now preserved when rescoping federated tokens (CVE-2026-44394), and user impersonation through application credentials is blocked (CVE-2026-42998). A separate hardening change also stops restricted application credentials from minting EC2 credentials via /credentials, with dedicated tests for the app-cred guard.

LDAP identity. Pagination in the LDAP backend was reworked so listings return all users beyond page_size rather than truncating at the first page.

CI. A single fix patches stable/2025.2 jobs — nodeset, a test skip, and the Keycloak audience mapper — to unblock the branch that received this week's CVE backports.