openstack/keystone — Stackers Network https://stackers.network/projects/openstack-keystone/ Weekly code-activity digest for openstack/keystone from Stackers Network. openstack/keystone — Week of 2026-06-13 https://stackers.network/projects/openstack-keystone/2026-06-13 https://stackers.network/projects/openstack-keystone/2026-06-13 Sat, 13 Jun 2026 00:00:00 +0000 Security disclosures. The week is dominated by a coordinated batch of CVE fixes, each landed on master and a stable branch. CVE-2026-42999 closes an RBAC policy bypass reachable through JSON body and query-string filters — the largest of the set at ~430 lines per landing… Security disclosures. The week is dominated by a coordinated batch of CVE fixes, each landed on master and a stable branch. CVE-2026-42999 closes an RBAC policy bypass reachable through JSON body and query-string filters — the largest of the set at ~430 lines per landing (990504). CVE-2026-43000 forbids trust operations initiated with application credentials, CVE-2026-44394 preserves expires_at when rescoping federated tokens so they cannot outlive their origin, and CVE-2026-42998 plugs a user-impersonation path through application credentials. A related hardening blocks app-cred tokens from authorizing OAuth1 request flows.

Delegation boundaries. Alongside the CVEs, a substantial ~1,000-line change enforces the delegation project boundary for delegated tokens, landing on master and a stable branch. A separate fix tightens the EC2 credential paths to enforce the application-credential project boundary, closing a parallel gap in the same area.

Federation tooling and CI. The devstack Keycloak client gains an audience mapper to support federated-token testing, and a stable-only CI tweak reuses the already-defined upper-constraints definition.

]]> openstack/keystone — Week of 2026-06-06 https://stackers.network/projects/openstack-keystone/2026-06-06 https://stackers.network/projects/openstack-keystone/2026-06-06 Sat, 06 Jun 2026 00:00:00 +0000 Security fixes. The week is dominated by a coordinated batch of CVE remediations, with most changes landing as master/backport pairs. A new enforcement of the delegation project boundary for delegated tokens is the largest piece at roughly 1,000 lines (990490). Alongside it… Security fixes. The week is dominated by a coordinated batch of CVE remediations, with most changes landing as master/backport pairs. A new enforcement of the delegation project boundary for delegated tokens is the largest piece at roughly 1,000 lines (990490). Alongside it: RBAC policy bypass via JSON body and query filters is closed off (CVE-2026-42999), trust operations are forbidden when acting through application credentials (CVE-2026-43000), expires_at is now preserved when rescoping federated tokens (CVE-2026-44394), and user impersonation through application credentials is blocked (CVE-2026-42998). A separate hardening change also stops restricted application credentials from minting EC2 credentials via /credentials, with dedicated tests for the app-cred guard.

LDAP identity. Pagination in the LDAP backend was reworked so listings return all users beyond page_size rather than truncating at the first page.

CI. A single fix patches stable/2025.2 jobs — nodeset, a test skip, and the Keycloak audience mapper — to unblock the branch that received this week's CVE backports.

]]>