CVE-2026-33551
Description
An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0. Restricted application credentials can create EC2 credentials. By using a restricted application credential to call the EC2 credential creation API, an authenticated user with only a reader role may obtain an EC2/S3 credential that carries the full set of the parent user's S3 permissions, effectively bypassing the role restrictions imposed on the application credential. Only deployments that use restricted application credentials in combination with the EC2/S3 compatibility API (swift3 / s3api) are affected.
How to fix
- openstack keystone26.1.1 or later
- keystone26.1.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openstack keystone | 14.0.0 ≤ v < 26.1.1, 27.0.0, 28.0.0, 29.0.0 | 26.1.1 |
| keystonePyPI | 14.0.0 ≤ v < 26.1.1 | 26.1.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.