The Keystone RBAC policy enforcer merges the raw JSON request body into the policy enforcement dictionary until it is overwritten by database values. This flaw is a type of Authorization Bypass, classified as CWE‑639. Because the merge occurs unconditionally, a malicious actor can inject policy target attributes such as user_id or project_id into the request. This allows the attacker to masquerade as another user or project and bypass all RBAC checks, enabling unauthorized creation, modification, or deletion of resources belonging to other users.

OpenStack Keystone releases earlier than version 29.0.2. The flaw was introduced in the commit 5ea59f52 (Rocky/14.0.0) and was fixed with the 29.0.2 release. The affected product is the Keystone identity service, which is used in OpenStack deployments to manage authentication and authorization.

The vulnerability carries a CVSS score of 6.0, indicating moderate risk. It is not listed in the CISA KEV catalog and the EPSS score is <1%. The flaw can be exploited by any authenticated HTTP client; the request can use any method and content type because Flask’s get_json is called with force=True. An attacker sends a crafted JSON payload with target attributes that overwrite the trusted values from the database, thus gaining unauthorized access to resources in other projects or users.