oss-security - [OSSA-2026-005] Keystone: Restricted application credentials can create EC2 credentials (CVE-2026-33551)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <adVCMfyYzsn4r8BF@yuggoth.org>
Date: Tue, 7 Apr 2026 17:43:13 +0000
From: Jeremy Stanley <fungi@...goth.org>
To: oss-security@...ts.openwall.com
Subject: [OSSA-2026-005] Keystone: Restricted application credentials can
 create EC2 credentials (CVE-2026-33551)

============================================================================
OSSA-2026-005: Restricted application credentials can create EC2 credentials
============================================================================

:Date: April 07, 2026
:CVE: CVE-2026-33551


Affects
~~~~~~~
- Keystone: >=14.0.0 <26.1.1, ==27.0.0, ==28.0.0, ==29.0.0


Description
~~~~~~~~~~~
Maxence Bornecque from Orange Cyberdefense CERT Vulnerability 
Intelligence Watch Team reported a vulnerability in Keystone's EC2 
credential creation endpoint. By using a restricted application 
credential to call the EC2 credential creation API, an authenticated 
user with only a reader role may obtain an EC2/S3 credential that 
carries the full set of the parent user's S3 permissions, 
effectively bypassing the role restrictions imposed on the 
application credential. Only deployments that use restricted 
application credentials in combination with the EC2/S3 compatibility 
API (swift3 / s3api) are affected.



Patches
~~~~~~~
- https://review.opendev.org/983597 (2024.1/caracal)
- https://review.opendev.org/983591 (2024.2/dalmatian)
- https://review.opendev.org/983589 (2025.1/epoxy)
- https://review.opendev.org/983588 (2025.2/flamingo)
- https://review.opendev.org/983593 (2026.1/gazpacho)
- https://review.opendev.org/983587 (2026.2/hibiscus)


Credits
~~~~~~~
- Maxence Bornecque from Orange Cyberdefense CERT Vulnerability
   Intelligence Watch Team (CVE-2026-33551)


References
~~~~~~~~~~
- https://launchpad.net/bugs/2142138
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33551


Notes
~~~~~
- The unmaintained/2024.1 branch is unmaintained and will receive no
   new point releases, but a patch for it is provided as a courtesy.

-- 
Jeremy Stanley
OpenStack Vulnerability Management Team
https://security.openstack.org/vmt.html

Download attachment "signature.asc" of type "application/pgp-signature" (964 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.