Red Hat Security Advisory

RHSA-2026:28044

Red Hat OpenStack Platform 17.1 (openstack-keystone) security update

Released 2026-06-22 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenStack Platform 17.1 openstack-keystone-1:19.0.2-17.1.20260529190847.54dd95d.el9ost, openstack-swift-2.27.1-17.1.20231004180819.el9ost, openstack-swift-account-2.27.1-17.1.20231004180819.el9ost +9

Fixes 3 records

TI-2026-25942 CVE-2026-33551 · GHSA-4phw-6824-6cfp

Incorrect authorization in OpenStack Keystone

MEDIUM 57

An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0.

CVSS 3.1MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00228 Published 2026-04-10 Fixed in 26.1.1 CWE-863

TI-2026-31181 CVE-2026-43001 · GHSA-hhq2-3832-xxcv

Incorrect authorization in OpenStack Keystone

LOW 35

An issue was discovered in OpenStack Keystone before 29.0.2.

CVSS 3.1HIGH 8.0 Network High privileges No interaction EPSS 0.00466 Published 2026-05-01 Fixed in 27.0.2, 28.0.2 +1 CWE-863

TI-2025-40226 CVE-2025-65073 · GHSA-hcqg-5g63-7j9h

Incorrect authorization in OpenStack Keystone

LOW 32

OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Signature to provide Keystone authorization.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00243 Published 2025-11-17 Partial fix · 26.0.1, 27.0.0 +1 CWE-863