Fix Keystone CVE-2026-{42999,42998,43000,43001,44394} (Yoga)#23

Merged

Alex-Welsh merged 10 commits into

stackhpc/yogafrom

Jun 5, 2026

Commits on Jun 4, 2026

Add test with noauth for s3tokens and ec2tokens

tobias-urdin
authored and
Alex-Welsh
committed
Add service user authentication to ec2 and s3 endpoints

xek
authored and
Alex-Welsh
committed
Block restricted app creds from creating EC2 credentials via /credentials

bbobrov
authored and
Alex-Welsh
committed
Enforce app cred project boundary on EC2 credential paths

xek
authored and
Alex-Welsh
committed
Enforce delegation project boundary for delegated tokens

xek
authored and
Alex-Welsh
committed
Fix user impersonation through application credentials (CVE-2026-42998)

authored and
Alex-Welsh
committed
Forbid trust operations using application credentials (CVE-2026-43000)

authored and
Alex-Welsh
committed
Preserve expires_at when rescoping federated tokens (CVE-2026-44394)

authored and
Alex-Welsh
committed
Prevent RBAC policy bypass via JSON body and query filters (CVE-2026-42999)

authored and
Alex-Welsh
committed

Commits on Jun 5, 2026

Fix pep8 formatting
Alex-Welsh
committed