CVE-2026-33551: OpenStack Keystone - EC2 Credential Creation Bypass via Restricted Application Credentials
Summary
CVE-2026-33551: OpenStack Keystone: Restricted application credentials can create EC2 credentials. Affects keystone versions >= 14.0.0, < 26.1.1. Fixed in 26.1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenStack Keystone is an identity service used for authentication and authorization in cloud environments. It provides a centralized service for managing users, roles, and permissions, enabling secure access to resources. This vulnerability affects versions 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0, where restricted application credentials can improperly create EC2 credentials, leading to unauthorized access.
Vulnerability Detail
An issue was discovered in OpenStack Keystone where restricted application credentials can create EC2 credentials. An authenticated user with only a reader role can exploit this by calling the EC2 credential creation API, obtaining EC2/S3 credentials that carry the full set of the parent user's S3 permissions. This effectively bypasses the role restrictions imposed on the application credential, posing a significant security risk to deployments using restricted application credentials alongside the EC2/S3 compatibility API.
How To Fix
Latest published version: 30.0.0 as of 22 Oct 2026
pip install --upgrade "keystone==30.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
26.1.1
This is the first release that contains the fix.
pip install --upgrade "keystone==26.1.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the EC2/S3 compatibility API (swift3/s3api) until the package can be updated to the patched version. This will prevent the exploitation of the vulnerability by restricting access to the EC2 credential creation API.
Conclusion
CVE-2026-33551 is a significant vulnerability in OpenStack Keystone that allows unauthorized EC2/S3 credential creation through restricted application credentials. It is crucial to update to the patched version to secure your deployment and prevent potential exploitation.
See every vulnerability recorded for keystone →
FAQ
The vulnerability allows unauthorized users to gain EC2/S3 credentials with full permissions, bypassing intended role restrictions.
Versions 14 through 26 before 26.1.1, as well as 27.0.0, 28.0.0, and 29.0.0 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 3.5, indicating a low severity level.
If immediate updates are not possible, disable the EC2/S3 compatibility API as a temporary workaround to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for keystone.
