Red Hat Security Advisory

RHSA-2026:39808

Red Hat OpenStack Services on OpenShift 18.0 (openstack-keystone) security update

Released 2026-07-15 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenStack Services on OpenShift 18.0 openstack-keystone-1:23.0.3-18.0.20260610133808.9e3dfb4.el9ost, python3-keystone-1:23.0.3-18.0.20260610133808.9e3dfb4.el9ost

Fixes 3 records

TI-2026-25942 CVE-2026-33551 · GHSA-4phw-6824-6cfp

Incorrect authorization in OpenStack Keystone

MEDIUM 57

An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0.

CVSS 3.1MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00228 Published 2026-04-10 Fixed in 26.1.1 CWE-863

TI-2026-31181 CVE-2026-43001 · GHSA-hhq2-3832-xxcv

Incorrect authorization in OpenStack Keystone

LOW 35

An issue was discovered in OpenStack Keystone before 29.0.2.

CVSS 3.1HIGH 8.0 Network High privileges No interaction EPSS 0.00466 Published 2026-05-01 Fixed in 27.0.2, 28.0.2 +1 CWE-863

TI-2026-29368 CVE-2026-40683 · GHSA-pfx2-9x9m-7ghx

Type confusion in OpenStack Keystone

LOW 34

In OpenStack Keystone before 28.0.1, the LDAP identity backend does not convert the user enabled attribute to a boolean when the user_enabled_invert configuration option is False (the default).

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00337 Published 2026-04-14 Partial fix · 25.0.1, 26.1.1 +2 CWE-843