Read the docs
TI-2026-25942 Aliases CVE-2026-33551GHSA-4phw-6824-6cfp

Incorrect authorization in OpenStack Keystone

Priority MEDIUM 57CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-863.

Summary

An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0. Restricted application credentials can create EC2 credentials. By using a restricted application credential to call the EC2 credential creation API, an authenticated user with only a reader role may obtain an EC2/S3 credential that carries the full set of the parent user's S3 permissions, effectively bypassing the role restrictions imposed on the application credential. Only deployments that use restricted application credentials in combination with the EC2/S3 compatibility API (swift3 / s3api) are affected.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00228 13th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Keystone (OpenStack): 26.1.1keystone (PyPI): 26.1.1Red Hat: 4 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenStackKeystone14.0.0 to before 26.1.1; 27.0.0; 28.0.0; 29.0.026.1.1Patch availableCNA
—keystone (PyPI)14.0.0 to before 26.1.126.1.1Patch availableGHSA-4phw-6824-6cfp
  • Keystone VendorOpenStack Affected 14.0.0 to before 26.1.1; 27.0.0; 28.0.0; 29.0.0 Fixed in 26.1.1 Patch available CNA
  • keystone (PyPI) Vendor— Affected 14.0.0 to before 26.1.1 Fixed in 26.1.1 Patch available GHSA-4phw-6824-6cfp

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:*14.0.0 to before 26.1.1VulnerableOpenStack
cpe:2.3:a:openstack:keystone:27.0.0:*:*:*:*:*:*:*27.0.0VulnerableOpenStack
cpe:2.3:a:openstack:keystone:28.0.0:*:*:*:*:*:*:*28.0.0VulnerableOpenStack
cpe:2.3:a:openstack:keystone:29.0.0:*:*:*:*:*:*:*29.0.0VulnerableOpenStack
  • cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:* Versions 14.0.0 to before 26.1.1 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:keystone:27.0.0:*:*:*:*:*:*:* Versions 27.0.0 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:keystone:28.0.0:*:*:*:*:*:*:* Versions 28.0.0 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:keystone:29.0.0:*:*:*:*:*:*:* Versions 29.0.0 Vulnerable ·OpenStack

Remediation

  • Fix · CNA Keystone (OpenStack) Fixed in 26.1.1
  • Fix · GHSA-4phw-6824-6cfp keystone (PyPI) Fixed in 26.1.1 Advisory →

Red Hat 4 advisories

  • RHSA-2026:94039 Released 2026-11-02 · Red Hat rating Important
    Red Hat OpenStack Platform 13.0 security advisory
    • Red Hat OpenStack Platform 13.0 - ELS openstack-keystone-1:13.0.4-10.el7ost, openstack-nova-1:17.0.13-43.el7ost, openstack-nova-api-1:17.0.13-43.el7ost +16
  • RHSA-2026:54757 Released 2026-08-13 · Red Hat rating Important
    Red Hat OpenStack Platform 16.2 security advisory
    • Red Hat OpenStack Platform 16.2 collectd-sensubility-0.2.1-1.1.el8ost, erlang-23.3.4.18-2.el8ost, erlang-asn1-23.3.4.18-2.el8ost +41
  • RHSA-2026:39808 Released 2026-07-15 · Red Hat rating Important
    Red Hat OpenStack Services on OpenShift 18.0 (openstack-keystone) security update
    • Red Hat OpenStack Services on OpenShift 18.0 openstack-keystone-1:23.0.3-18.0.20260610133808.9e3dfb4.el9ost, python3-keystone-1:23.0.3-18.0.20260610133808.9e3dfb4.el9ost
Show 1 more Red Hat advisories
  • RHSA-2026:28044 Released 2026-06-22 · Red Hat rating Important
    Red Hat OpenStack Platform 17.1 (openstack-keystone) security update
    • Red Hat OpenStack Platform 17.1 openstack-keystone-1:19.0.2-17.1.20260529190847.54dd95d.el9ost, openstack-swift-2.27.1-17.1.20231004180819.el9ost, openstack-swift-account-2.27.1-17.1.20231004180819.el9ost +9

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenStack Platform 13.0 - ELSFixed RHSA-2026:94039
Red Hat OpenStack Platform 16.2Fixed RHSA-2026:54757
Red Hat OpenStack Platform 17.1Fixed RHSA-2026:28044
Red Hat OpenStack Services on OpenShift 18.0Fixed RHSA-2026:39808
Not affected: 3 products
  • Red Hat OpenStack Platform 13.0 - ELS
  • Red Hat OpenStack Platform 16.2
  • Red Hat OpenStack Platform 17.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33551
  2. 2026-10-03 Alias added: GHSA-4phw-6824-6cfp
  3. 2026-11-03 Fix available: RHSA-2026:94039 · Red Hat
  4. 2026-11-03 Fix available: Red Hat OpenStack Platform 13.0 - ELS · Red Hat

References

Exploit 1

Patch 2

Advisory 1

Other 2

  • TI-2020-10091 An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. CVSS 3.1HIGH 8.8
  • TI-2020-10090 An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. CVSS 3.1HIGH 8.8
  • TI-2019-14184 OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials… CVSS 3.1HIGH 8.8
  • TI-2020-10089 An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. CVSS 3.1HIGH 8.8
  • TI-2014-02273 The V3 API in OpenStack Identity (Keystone) 2013.1 before 2013.2.4 and icehouse before… CVSS 2.0HIGH 7.8
  • TI-2012-03798 The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2… CVSS 2.0HIGH 7.5
See all 43 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences