CVE Feed

    Dashboard / CVE / CVE-2026-33551

    CVE-2026-33551

    An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0. Restricted application credentials can create EC2 credentials. By using a restricted application credential to call the EC2 credential creation API, an authenticated user with only a reader role may obtain an EC2/S3 credential that carries the full set of the parent user's S3 permissions, effectively bypassing the role restrictions imposed on the application credential. Only deployments that use restricted application credentials in combination with the EC2/S3 compatibility API (swift3 / s3api) are affected.

    Published:Apr 7, 2026
    Last Modified:Jun 5, 2026
    EPS:Apr 10, 2026
    EPSS Score:0.00033
    CVSS Score:3.5

    Affected Products

    Vendor
    Openstack
    Product
    Keystone

    Exploits

    https://bugs.launchpad.net/keystone/+bug/2142138https://bugs.launchpad.net/keystone/+bug/2142138

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-80183 (CVSS 7.1) — In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every …
    CVE-2026-80184 (CVSS 7.6) — In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms (OAuth1 access to…
    CVE-2026-80182 (CVSS 7.6) — In OpenStack Keystone before 29.0.3, tokens obtained via OAuth1 access token, application credential, or trust…
    CVE-2026-2035364 (CVSS 8.1) — A flaw was found in OpenStack Keystone where delegation boundary enforcement is incomplete across trust, appli…
    CVE-2026-42999 (CVSS 6) — An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone RBAC policy enforcer in enforce_call…
    CVE-2026-43000 (CVSS 6) — An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impe…
    CVE-2026-42998 (CVSS 6) — An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone application credential authenticatio…
    CVE-2026-44394 (CVSS 6) — An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone federated token rescoping mechanism …
    CVE-2026-43001 (CVSS 7.9) — An issue was discovered in OpenStack Keystone before 29.0.2. POST /v3/credentials did not validate that the ca…
    CVE-2026-40683 (CVSS 7.7) — In OpenStack Keystone before 28.0.1, the LDAP identity backend does not convert the user enabled attribute to …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High