p PatchFirst

CVE-2026-33551

CVE-2026-33551

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0. Restricted application credentials can create EC2 credentials. By using a restricted application credential to call the EC2 credential creation API, an authenticated user with only a reader role may obtain an EC2/S3 credential that carries the full set of the parent user's S3 permissions, effectively bypassing the role restrictions imposed on the application credential. Only deployments that use restricted application credentials in combination with the EC2/S3 compatibility API (swift3 / s3api) are affected.

CVSS 3.5 · Low · EPSS 0.3% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • keystone

    Versions
    • ≥ 14.0.0, < 26.1.1: Affected (semver)
    • 27.0.0: Affected (semver)
    • 28.0.0: Affected (semver)
    • 29.0.0: Affected (semver)

    Update to 26.1.1

  • keystone Debian:12

    Versions
    • 2:22.0.0-2
    • 2:22.0.2-0+deb12u1
    Affected ranges
    • ECOSYSTEM: < 2:22.0.2-0+deb12u2

    Update to 2:22.0.2-0+deb12u2

  • keystone Debian:13

    Versions
    • 2:27.0.0-3
    • 2:27.0.0-3+deb13u1
    Affected ranges
    • ECOSYSTEM: < 2:27.0.0-3+deb13u3

    Update to 2:27.0.0-3+deb13u3

  • keystone Debian:14

    Versions
    • 2:27.0.0-3
    • 2:28.0.0-1
    • 2:28.0.0-2
    • 2:28.0.0-3
    • 2:28.0.0-4
    • 2:28.0.0-5
    • 2:28.0.0-6
    • 2:28.0.0~rc1-1
    • 2:28.0.0~rc1-2
    • 2:28.0.0~rc1-4
    • 2:29.0.0-1
    • 2:29.0.0~rc1-1
    • 2:29.0.0~rc1-2
    Affected ranges
    • ECOSYSTEM: < 2:29.0.0-2

    Update to 2:29.0.0-2

  • keystone PyPI

    Versions
    • 14.0.0
    • 14.0.1
    • 14.1.0
    • 14.2.0
    • 15.0.0
    • 15.0.0.0rc1
    • 15.0.0.0rc2
    • 15.0.1
    • 16.0.0
    • 16.0.0.0rc1
    • 16.0.0.0rc2
    • 16.0.1
    • 16.0.2
    • 17.0.0
    • 17.0.0.0rc1
    • 17.0.0.0rc2
    • 17.0.1
    • 18.0.0
    • 18.0.0.0rc1
    • 18.1.0
    • 19.0.0
    • 19.0.0.0rc1
    • 19.0.0.0rc2
    • 19.0.1
    • 20.0.0
    • 20.0.0.0rc1
    • 20.0.1
    • 21.0.0
    • 21.0.0.0rc1
    • 21.0.1
    • 22.0.0
    • 22.0.0.0rc1
    • 22.0.1
    • 22.0.2
    • 23.0.0
    • 23.0.0.0rc1
    • 23.0.1
    • 23.0.2
    • 24.0.0
    • 24.0.0.0rc1
    • 24.1.0
    • 25.0.0
    • 25.0.0.0rc1
    • 26.0.0
    • 26.0.0.0rc1
    • 26.1.0
    Affected ranges
    • ECOSYSTEM: ≥ 14.0.0, < 26.1.1

    Update to 26.1.1

  • keystone Ubuntu:Pro:16.04:LTS

    Versions
    • 2:8.0.0-0ubuntu1
    • 2:9.0.0~b1-0ubuntu1
    • 2:9.0.0~b2-0ubuntu1
    • 2:9.0.0~b3-0ubuntu1
    • 2:9.0.0~rc1-0ubuntu1
    • 2:9.0.0-0ubuntu1
    • 2:9.0.2-0ubuntu1
    • 2:9.0.2-0ubuntu2
    • 2:9.1.0-0ubuntu1
    • 2:9.2.0-0ubuntu1
    • 2:9.3.0-0ubuntu1
    • 2:9.3.0-0ubuntu2
    • 2:9.3.0-0ubuntu3
    • 2:9.3.0-0ubuntu3.1
    • 2:9.3.0-0ubuntu3.2
    • 2:9.3.0-0ubuntu3.2+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • keystone Ubuntu:Pro:18.04:LTS

    Versions
    • 2:12.0.0-0ubuntu1
    • 2:13.0.0~b1-0ubuntu1
    • 2:13.0.0~b2-0ubuntu1
    • 2:13.0.0~b3-0ubuntu1
    • 2:13.0.0~rc1-0ubuntu1
    • 2:13.0.0~rc2-0ubuntu1
    • 2:13.0.0-0ubuntu1
    • 2:13.0.1-0ubuntu1
    • 2:13.0.2-0ubuntu1
    • 2:13.0.2-0ubuntu3
    • 2:13.0.4-0ubuntu1
    • 2:13.0.4-0ubuntu1+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • keystone Ubuntu:Pro:20.04:LTS

    Versions
    • 2:16.0.0-0ubuntu1
    • 2:17.0.0~b1~git2019121613.db81fee63-0ubuntu1
    • 2:17.0.0~b2~git2020020513.99733f172-0ubuntu1
    • 2:17.0.0~b3~git2020032415.9f9040257-0ubuntu1
    • 2:17.0.0~b3~git2020032415.9f9040257-0ubuntu2
    • 2:17.0.0~b3~git2020041013.7bb6314e4-0ubuntu1
    • 2:17.0.0-0ubuntu0.20.04.1
    • 2:17.0.1-0ubuntu1
    • 2:17.0.1-0ubuntu2
    • 2:17.0.1-0ubuntu2+esm1
    • 2:17.0.1-0ubuntu2+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • keystone Ubuntu:22.04:LTS

    Versions
    • 2:20.0.0-0ubuntu1
    • 2:20.0.0+git2021120815.2ddf8f321-0ubuntu1
    • 2:20.0.0+git2022011217.771c943ad-0ubuntu1
    • 2:20.0.0+git2022030313.a3fc9e7c3-0ubuntu1
    • 2:21.0.0-0ubuntu1
    • 2:21.0.1-0ubuntu1
    • 2:21.0.1-0ubuntu2
    • 2:21.0.1-0ubuntu2.1
    • 2:21.0.1-0ubuntu2.2
    Affected ranges
    • ECOSYSTEM: < 2:21.0.1-0ubuntu2.4

    Update to 2:21.0.1-0ubuntu2.4

  • keystone Ubuntu:24.04:LTS

    Versions
    • 2:24.0.0-0ubuntu1
    • 2:24.0.0+git2024011916.adfa92b4-0ubuntu1
    • 2:25.0.0~rc1-0ubuntu1
    • 2:25.0.0-0ubuntu1
    • 2:25.0.0-0ubuntu1.1
    • 2:25.0.0-0ubuntu1.2
    Affected ranges
    • ECOSYSTEM: < 2:25.0.0-0ubuntu1.4

    Update to 2:25.0.0-0ubuntu1.4

  • keystone Ubuntu:25.10

    Versions
    • 2:27.0.0-0ubuntu1
    • 2:27.0.0+git2025080113.e066e18ab-0ubuntu1
    • 2:28.0.0~rc1-0ubuntu1
    • 2:28.0.0-0ubuntu1
    • 2:28.0.0-0ubuntu1.1
    Affected ranges
    • ECOSYSTEM: < 2:28.0.0-0ubuntu1.3

    Update to 2:28.0.0-0ubuntu1.3

  • keystone Ubuntu:26.04:LTS

    Versions
    • 2:28.0.0-0ubuntu1
    • 2:28.0.0-0ubuntu2
    • 2:28.0.0+git20260119.61.8a42793e7-0ubuntu1
    • 2:29.0.0~rc1-0ubuntu1
    • 2:29.0.0-0ubuntu1
    Affected ranges
    • ECOSYSTEM: < 2:29.0.0-0ubuntu1.2

    Update to 2:29.0.0-0ubuntu1.2

Original sources

Check your server →