Bug 2451037 (CVE-2026-33551) - CVE-2026-33551 openstack-keystone: OpenStack Keystone: Privilege escalation through EC2 credential creation
Summary: CVE-2026-33551 openstack-keystone: OpenStack Keystone: Privilege escalation t...
Keywords:
Status: NEW
Alias: CVE-2026-33551
Deadline: 2026-04-07
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-03-25 00:11 UTC by OSIDB Bzimport
Modified: 2026-08-13 23:39 UTC (History)
8 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:28044 0 None None None 2026-06-22 20:59:00 UTC
Red Hat Product Errata RHSA-2026:39808 0 None None None 2026-07-15 09:50:02 UTC
Red Hat Product Errata RHSA-2026:54757 0 None None None 2026-08-13 23:39:11 UTC

Description OSIDB Bzimport 2026-03-25 00:11:30 UTC 
Maxence Bornecque from Orange Cyberdefense CERT Vulnerability Intelligence Watch Team reported a vulnerability in Keystone's EC2 credential creation endpoint. By using a restricted application credential to call the EC2 credential creation API, an authenticated user with only a reader role may obtain an EC2/S3 credential that carries the full set of the parent user's S3 permissions, effectively bypassing the role restrictions imposed on the application credential. Only deployments that use restricted application credentials in combination with the EC2/S3 compatibility API (swift3 / s3api) are affected.
Comment 3 errata-xmlrpc 2026-06-22 20:58:58 UTC 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 17.1 for RHEL 9

Via RHSA-2026:28044 https://access.redhat.com/errata/RHSA-2026:28044
Comment 4 errata-xmlrpc 2026-07-15 09:50:01 UTC 
This issue has been addressed in the following products:

  Red Hat OpenStack Services on OpenShift 18.0

Via RHSA-2026:39808 https://access.redhat.com/errata/RHSA-2026:39808
Comment 5 errata-xmlrpc 2026-08-13 23:39:10 UTC 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 16.2

Via RHSA-2026:54757 https://access.redhat.com/errata/RHSA-2026:54757
Note You need to log in before you can comment on or make changes to this bug.