Fix Keystone CVE-2026-{42999,42998,43000,43001,44394} (Caracal)#24

Merged

Alex-Welsh merged 8 commits into

stackhpc/2024.1from

caracal-cve-2026-42998-43001

Jun 5, 2026

Commits on Jun 4, 2026

Block restricted app creds from creating EC2 credentials via /credentials

bbobrov
authored and
Alex-Welsh
committed
Enforce app cred project boundary on EC2 credential paths

xek
authored and
Alex-Welsh
committed
Enforce delegation project boundary for delegated tokens

xek
authored and
Alex-Welsh
committed
Fix user impersonation through application credentials (CVE-2026-42998)

authored and
Alex-Welsh
committed
Forbid trust operations using application credentials (CVE-2026-43000)

authored and
Alex-Welsh
committed
Preserve expires_at when rescoping federated tokens (CVE-2026-44394)

authored and
Alex-Welsh
committed
Prevent RBAC policy bypass via JSON body and query filters (CVE-2026-42999)

authored and
Alex-Welsh
committed

Commits on Jun 5, 2026

Fix pep8 formatting
Alex-Welsh
committed