openstack/keystone — Week of 2026-06-13

Security disclosures. The week is dominated by a coordinated batch of CVE fixes, each landed on master and a stable branch. CVE-2026-42999 closes an RBAC policy bypass reachable through JSON body and query-string filters — the largest of the set at ~430 lines per landing (990504). CVE-2026-43000 forbids trust operations initiated with application credentials, CVE-2026-44394 preserves expires_at when rescoping federated tokens so they cannot outlive their origin, and CVE-2026-42998 plugs a user-impersonation path through application credentials. A related hardening blocks app-cred tokens from authorizing OAuth1 request flows.

Delegation boundaries. Alongside the CVEs, a substantial ~1,000-line change enforces the delegation project boundary for delegated tokens, landing on master and a stable branch. A separate fix tightens the EC2 credential paths to enforce the application-credential project boundary, closing a parallel gap in the same area.

Federation tooling and CI. The devstack Keycloak client gains an audience mapper to support federated-token testing, and a stable-only CI tweak reuses the already-defined upper-constraints definition.