Improper access control in OpenStack Keystone - CVE-2026-33551
Published: April 8, 2026
Vulnerability identifier: #VU125222
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-33551
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to bypass application credential restrictions and obtain broader S3 permissions.
The vulnerability exists due to improper access control in the EC2 credential creation endpoint when handling requests to create EC2 credentials with a restricted application credential. A remote user can call the EC2 credential creation API to bypass application credential restrictions and obtain broader S3 permissions.
Only deployments that use restricted application credentials together with the EC2/S3 compatibility API (swift3 / s3api) are affected.
Affected software
OpenStack Keystone
Red Hat OpenStack
openstack-swift (Red Hat package)
openstack-keystone (Red Hat package)
openstack-tempest (Red Hat package)
Red Hat OpenStack
openstack-swift (Red Hat package)
openstack-keystone (Red Hat package)
openstack-tempest (Red Hat package)
How to mitigate CVE-2026-33551
Install security update from vendor's website.
OpenStack Keystone - update to 26.1.1
openstack-swift (Red Hat package) - update to 2.27.1-17.1.20231004180819.el9ost
Red Hat OpenStack - update to 17.1
openstack-keystone (Red Hat package) - update to 19.0.2-17.1.20260529190847.54dd95d.el9ost
openstack-tempest (Red Hat package) - update to 33.0.0-17.1.20260406141650.1580f6f.el9ost
openstack-swift (Red Hat package) - update to 2.27.1-17.1.20231004180819.el9ost
Red Hat OpenStack - update to 17.1
openstack-keystone (Red Hat package) - update to 19.0.2-17.1.20260529190847.54dd95d.el9ost
openstack-tempest (Red Hat package) - update to 33.0.0-17.1.20260406141650.1580f6f.el9ost