Skip to content
Fencer Vulns
low 3.5

CVE-2026-33551 json

OpenStack Keystone: Restricted application credentials can create EC2 credentials

published 2026-04-10 7 mo ago modified 2026-10-26 13 d ago also GHSA-4phw-6824-6cfp , PYSEC-2026-202 , EUVD-2026-21278

cvss
3.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 13%
public exploits
0
none known

Summary

An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0. Restricted application credentials can create EC2 credentials. By using a restricted application credential to call the EC2 credential creation API, an authenticated user with only a reader role may obtain an EC2/S3 credential that carries the full set of the parent user's S3 permissions, effectively bypassing the role restrictions imposed on the application credential. Only deployments that use restricted application credentials in combination with the EC2/S3 compatibility API (swift3 / s3api) are affected.

Patch / fix

  • pypi keystone 26.1.1
  • OpenStack Keystone 26.1.1
  • keystone Debian 12 2:22.0.2-0+deb12u2
  • keystone Debian 13 2:27.0.0-3+deb13u3
  • keystone Debian 14 2:29.0.0-2

debian advisories DEBIAN-CVE-2026-33551

  • keystone Ubuntu 22.04 LTS 2:21.0.1-0ubuntu2.4
  • keystone Ubuntu 24.04 LTS 2:25.0.0-0ubuntu1.4
  • keystone Ubuntu 25.10 2:28.0.0-0ubuntu1.3
  • keystone Ubuntu 26.04 LTS 2:29.0.0-0ubuntu1.2

ubuntu advisories UBUNTU-CVE-2026-33551

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • etcd openstack 16.2 3.3.23-22.el8ost
  • erlang openstack 16.2 23.3.4.18-2.el8ost
  • erlang-ssl openstack 16.2 23.3.4.18-2.el8ost
  • erlang-asn1 openstack 16.2 23.3.4.18-2.el8ost
  • erlang-erts openstack 16.2 23.3.4.18-2.el8ost
  • erlang-hipe openstack 16.2 23.3.4.18-2.el8ost
  • erlang-sasl openstack 16.2 23.3.4.18-2.el8ost
  • erlang-snmp openstack 16.2 23.3.4.18-2.el8ost

red hat advisories RHSA-2026:54757RHSA-2026:39808RHSA-2026:28044

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-33551 updated cvss 3.5

openstack-keystone: OpenStack Keystone: Privilege escalation through EC2 credential creation

  • Red Hat OpenStack Platform 13.0 - ELS python-keystone 13.0.4-10.el7ost, openstack-keystone 13.0.4-10.el7ost
    fixed: vendor fix RHSA-2026:94039
  • Red Hat OpenStack Platform 16.2 python3-keystone 16.0.3-2.20260616134936.9d699a7.el8ost, openstack-keystone 16.0.3-2.20260616134936.9d699a7.el8ost
    fixed: vendor fix RHSA-2026:54757
  • Red Hat OpenStack Platform 17.1 python3-keystone 19.0.2-17.1.20260529190847.54dd95d.el9ost, openstack-keystone 19.0.2-17.1.20260529190847.54dd95d.el9ost
    fixed: vendor fix RHSA-2026:28044
  • Red Hat OpenStack Services on OpenShift 18.0 python3-keystone 23.0.3-18.0.20260610133808.9e3dfb4.el9ost, openstack-keystone 23.0.3-18.0.20260610133808.9e3dfb4.el9ost
    fixed: vendor fix RHSA-2026:39808
  • Red Hat OpenStack Platform 13.0 - ELS python-webob 1.7.2-2.el7ost, python-nova 17.0.13-43.el7ost, openstack-heat 10.0.3-21.el7ost, openstack-nova 17.0.13-43.el7ost, openstack-heat-api 10.0.3-21.el7ost, python-nova-tests 17.0.13-43.el7ost, +18 more Red Hat OpenStack Platform 16.2 etcd 3.3.23-22.el8ost, erlang 23.3.4.18-2.el8ost, python-pyasn1 0.4.6-4.el8ost, erlang-ssl 23.3.4.18-2.el8ost, python3-pyasn1 0.4.6-4.el8ost, erlang-asn1 23.3.4.18-2.el8ost, +79 more Red Hat OpenStack Platform 17.1 python3-swift 2.27.1-17.1.20231004180819.el9ost, openstack-swift 2.27.1-17.1.20231004180819.el9ost, openstack-swift-proxy 2.27.1-17.1.20231004180819.el9ost, openstack-swift-object 2.27.1-17.1.20231004180819.el9ost, openstack-swift-account 2.27.1-17.1.20231004180819.el9ost, python3-tempest 33.0.0-17.1.20260406141650.1580f6f.el9ost, +4 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
7 mo ago

Exploit prediction

0.23% chance of exploitation in the next 30 days, higher than 13% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • bugs.launchpad.net https://bugs.launchpad.net/keystone/+bug/2142138 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 3.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N
NVD 3.1 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
OSV 3.1 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
GitHub 3.1 3.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N

Affected packages

ecosystem package affected fixed in
pypi keystone
>=14.0.0, <26.1.1
26.1.1

Affected products

  • OpenStack Keystone

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.