Sign in
Deutsch English Español Polski
Medium

An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0. Restricted application credentials can create EC2 credentials. By using a restricted application

  • Disclosed: 10.04.2026
  • Updated: 11.10.2026 12:19

An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0. Restricted application credentials can create EC2 credentials. By using a restricted application credential to call the EC2 credential creation API, an authenticated user with only a reader role may obtain an EC2/S3 credential that carries the full set of the parent user's S3 permissions, effectively bypassing the role restrictions imposed on the application credential. Only deployments that use restricted application credentials in combination with the EC2/S3 compatibility API (swift3 / s3api) are affected.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Python (PyPI) keystone >= 14.0.0, < 26.1.1 26.1.1

References

CVSS score 5.3/10
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness (CWE)
CWE-863
Platform
Python (PyPI)
Package
keystone
Disclosed
10.04.2026
Updated
11.10.2026 12:19

Sources and licenses

OSV / GitHub Advisory Database - GHSA-4phw-6824-6cfp - CC BY 4.0

OSV / GitHub Advisory Database - PYSEC-2026-202 - PyPA Advisory Database; CC BY 4.0

Vulnerability history: keystone

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (42) in the archive
Total entries
42
First → latest
09.2012 05.2026
Without a fix
3
Exploited in attacks
0

Severity breakdown

  • Critical 1
  • High 18
  • Medium 21
  • Low 1
  • Unrated 1

Disclosures per year

earlier: 13

Severity:
  1. OpenStack Keystone has an Incorrect Authorization Issue
    High · 7.9 CVE-2026-43001 >= 13.0.0, <= 29.0.1 no fix
  2. OpenStack Keystone: LDAP identity backend does not convert enabled attribute to boolean
    High · 7.7 CVE-2026-40683 < 28.0.1 28.0.1
  3. An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0. Restricted application credentials can create EC2 credentials. By using a restricted application this entry
    Medium · 5.3 CVE-2026-33551 >= 14.0.0, < 26.1.1 26.1.1
  4. OpenStack Keystone allows /v3/ec2tokens or /v3/s3tokens request with valid AWS Signature to provide Keystone authorization.
    High · 7.5 CVE-2025-65073 < 26.0.1, >= 27.0.0.0rc1, < 27.0.0, >= 28.0.0.0rc1, < 28.0.0 26.0.1, 27.0.0, 28.0.0
  5. Openstack Keystone Incorrect Authorization vulnerability
    Critical · 9.1 CVE-2021-3563 <= 21.0.0 no fix
  6. OpenStack Keystone allows information disclosure during account locking
    High · 7.5 CVE-2021-38155 >= 10.0, < 16.0.2, >= 17.0, < 17.0.1, >= 18.0, < 18.0.1, >= 19.0, < 19.0.1 16.0.2, 17.0.1, 18.0.1, 19.0.1
  7. OpenStack Keystone Improper Authentication vulnerability
    High CVE-2012-4456 >= 2012.1, < 2012.1.2 2012.1.2
  8. An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any user authenticated within a limited scope (trust/oauth/application credential) can create an EC2 credential with an escalat
    High · 8.8 CVE-2020-12689 < 15.0.1 15.0.1
  9. An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any authenticated user can create an EC2 credential for themselves for a project that they have a specified role on, and then p
    High · 8.8 CVE-2020-12691 < 15.0.1 15.0.1
  10. Insufficient Session Expiration in OpenStack Keystone
    High · 8.8 CVE-2020-12690 < 15.0.1, >= 16.0.0.0rc1, < 16.0.0 15.0.1, 16.0.0
  11. OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforc
    High · 8.8 CVE-2019-19687 < 16.0.1 16.0.1
  12. An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service (keystone). An authenticated federated user could request permissions to a project and uninten
    High · 7.2 CVE-2017-2673 >= 9.0.0, < 10.0.2, >= 11.0.0, < 11.0.1 10.0.2, 11.0.1
  13. OpenStack Identity Keystone and keystonemiddleware Insufficiently Protected Credentials
    High · 7.5 CVE-2015-7546 >= 8.0, < 8.1.0, >= 9.0.0.0b1, < 9.0.0.0b2 8.1.0, 9.0.0.0b2
  14. OpenStack Identity (Keystone) Multiple vulnerabilities in revocation events
    High · 6.5 CVE-2014-5251 < 8.0.0a0 8.0.0a0
  15. OpenStack Identity (Keystone) UUID v2 tokens does not expire with revocation events
    High · 6.5 CVE-2014-5252 < 8.0.0a0 8.0.0a0
  16. OpenStack Keystone Domain-scoped tokens don't get revoked
    High · 6.5 CVE-2014-5253 < 8.0.0a0 8.0.0a0
  17. OpenStack Identity (Keystone) DoS through V3 API authentication chaining
    High · 7.5 CVE-2014-2828 < 8.0.0a0 8.0.0a0
  18. OpenStack Identity (Keystone) Trustee token revocations does not work with memcache backend
    High · 6.5 CVE-2014-2237 < 8.0.0a0 8.0.0a0
  19. OpenStack Keystone, as used in OpenStack Folsom 2012.2, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by creating
    High · 5.9 CVE-2012-5563 all versions no fix
  20. OpenStack Keystone Allows Remote User Account Creation
    High · 7.5 CVE-2012-3542 < 2012.1 2012.1

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.