PT-2026-31855 · Openstack · Openstack Keystone

Published 2026-04-10 · Updated 2026-04-10 · CVE-2026-33551

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenStack Keystone versions 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0

Description A flaw exists in OpenStack Keystone where restricted application credentials can be used to create EC2 credentials. An authenticated user with a reader role can potentially obtain EC2/S3 credentials with the full permissions of the parent user, bypassing intended role restrictions. This occurs when using restricted application credentials with the EC2/S3 compatibility API (swift3 / s3api).

Recommendations Update to OpenStack Keystone version 26.1.1 or later. Update to OpenStack Keystone version 27.0.1 or later. Update to OpenStack Keystone version 28.0.1 or later. Update to OpenStack Keystone version 29.0.1 or later.

Exploit

Fix

LPE

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-33551

Affected Products

Openstack Keystone

References · 6

• 🔥 https://bugs.launchpad.net/keystone/+bug/2142138 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-33551 · Security Note
• http://openwall.com/lists/oss-security/2026/04/07/12 · Note
• https://twitter.com/VulmonFeeds/status/2042536165635498050 · Twitter Post
• https://twitter.com/CVEnew/status/2042561817583718750 · Twitter Post
• https://security.openstack.org/ossa/OSSA-2026-005.html · Note