EUVD-2026-21278Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0. Restricted application credentials can create EC2 credentials. By using a restricted application credential to call the EC2 credential creation API, an authenticated user with only a reader role may obtain an EC2/S3 credential that carries the full set of the parent user's S3 permissions, effectively bypassing the role restrictions imposed on the application credential. Only deployments that use restricted application credentials in combination with the EC2/S3 compatibility API (swift3 / s3api) are affected.
AnalysisAI
OpenStack Keystone 14 through 29.x allows authenticated users with restricted application credentials to create EC2 credentials that inherit the parent user's full S3 permissions, bypassing role restrictions. This privilege escalation affects only deployments combining restricted application credentials with the EC2/S3 compatibility API (swift3/s3api), and requires valid authentication credentials and moderate attack complexity to exploit.
Technical ContextAI
OpenStack Keystone manages identity and access control for OpenStack deployments. Application credentials are a scoped credential mechanism designed to limit permissions for specific applications. The EC2/S3 compatibility API (swift3/s3api) provides Amazon-compatible credential formats for object storage access. CWE-863 (Incorrect Authorization) describes the root cause: the EC2 credential creation endpoint fails to properly validate and enforce the restrictions attached to a parent application credential. When a restricted application credential (intentionally limited to certain roles or permissions) calls the EC2 credential API, the resulting EC2 credential incorrectly inherits the full set of the parent user's S3 permissions rather than the restricted set, creating an authorization bypass. This affects Keystone versions from 14 through 26.0.x, 27.0.0, 28.0.0, and 29.0.0 across multiple platforms including Ubuntu (7 releases) and Debian (6 releases).
RemediationAI
Upgrade OpenStack Keystone to version 26.1.1, 27.1.0, 28.1.0, or 29.1.0 or later depending on your current deployment version. For organizations unable to immediately patch, restrict the use of restricted application credentials in conjunction with EC2/S3 compatibility API endpoints until upgrades are completed, or disable the swift3/s3api compatibility layer if not required. Detailed patch guidance and deployment notes are available in the OpenStack Security Advisory (https://security.openstack.org/ossa/OSSA-2026-005.html) and the Launchpad bug report (https://bugs.launchpad.net/keystone/+bug/2142138). Review existing restricted application credentials and verify they have not been leveraged to create EC2 credentials in affected versions.
CSV Injection (aka Excel Macro Injection or Formula Injection) exists in admin/server/api/download.js and lib/list/getCS
Keystone is a headless CMS for Node.js - built with GraphQL and React.`@keystone-6/core@3.0.0 || 3.0.1` users that use `
@keystone-6/core is a core package for Keystone 6, a content management system for Node.js. Rated critical severity (CVS
An arbitrary file upload vulnerability in the file upload module of Keystone v4.2.1 allows attackers to execute arbitrar
KeystoneJS before 4.0.0-beta.7 allows application-wide CSRF bypass by removing the CSRF parameter and value, aka SecureL
OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Rated high severity (CVSS
OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allow
A cross-site scripting (XSS) vulnerability exists in fields/types/markdown/MarkdownType.js in KeystoneJS before 4.0.0-be
A flaw was found in Keystone. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable. Public explo
OpenStack Identity (Keystone) before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2 allows remote authenticate
OpenStack Identity (Keystone) before 2014.1.1 does not properly handle when a role is assigned to a group that has the s
OpenStack Identity (Keystone) Folsom 2012.2.4 and earlier, Grizzly before 2013.1.1, and Havana does not immediately revo
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| xenial | needs-triage | - |
| bionic | needs-triage | - |
| focal | needs-triage | - |
| jammy | needs-triage | - |
| noble | needs-triage | - |
| questing | needs-triage | - |
| upstream | needs-triage | - |
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | vulnerable | 2:18.0.0-3+deb11u1 | - |
| bullseye (security) | vulnerable | 2:18.1.0-1+deb11u2 | - |
| bookworm, bookworm (security) | vulnerable | 2:22.0.2-0+deb12u1 | - |
| trixie (security), trixie | vulnerable | 2:27.0.0-3+deb13u1 | - |
| forky, sid | vulnerable | 2:29.0.0-1 | - |
| (unstable) | fixed | (unfixed) | - |
Share
External POC / Exploit Code
Leaving vuln.today