Description
An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0. Restricted application credentials can create EC2 credentials. By using a restricted application credential to call the EC2 credential creation API, an authenticated user with only a reader role may obtain an EC2/S3 credential that carries the full set of the parent user's S3 permissions, effectively bypassing the role restrictions imposed on the application credential. Only deployments that use restricted application credentials in combination with the EC2/S3 compatibility API (swift3 / s3api) are affected.
References (3)
Core 3
Scores
CVSS v3
3.5
EPSS
0.0021
EPSS Percentile
11.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-863
Status
published
Products (9)
openstack/keystone
27.0.0
openstack/keystone
28.0.0
openstack/keystone
29.0.0
OpenStack/Keystone
14.0.0 - 26.1.1
openstack/keystone
14.0.0 - 26.1.1
OpenStack/Keystone
27.0.0
OpenStack/Keystone
28.0.0
OpenStack/Keystone
29.0.0
pypi/keystone
14.0.0 - 26.1.1PyPI
Published
Apr 10, 2026
Tracked Since
Apr 10, 2026