CVE-2026-33551: OpenStack Keystone Auth Bypass Vulnerability

CVE-2026-33551 Overview

An authorization bypass vulnerability has been discovered in OpenStack Keystone, the identity service component of OpenStack cloud deployments. The vulnerability allows authenticated users with restricted application credentials to create EC2 credentials that carry the full set of the parent user's S3 permissions, effectively bypassing the role restrictions imposed on the application credential.

This flaw specifically affects deployments that use restricted application credentials in combination with the EC2/S3 compatibility API (swift3/s3api). By exploiting this vulnerability, an authenticated user with only a reader role can escalate their permissions to obtain full S3 access rights through the EC2 credential creation API.

Critical Impact

Users with limited reader-role application credentials can bypass role restrictions and obtain full S3 permissions by creating EC2 credentials, undermining the principle of least privilege in affected OpenStack deployments.

Affected Products

• OpenStack Keystone versions 14 through 26 before 26.1.1
• OpenStack Keystone version 27.0.0
• OpenStack Keystone version 28.0.0
• OpenStack Keystone version 29.0.0

Discovery Timeline

• 2026-04-10 - CVE-2026-33551 published to NVD
• 2026-04-13 - Last updated in NVD database

Technical Details for CVE-2026-33551

Vulnerability Analysis

This vulnerability is classified as CWE-863 (Incorrect Authorization), indicating a fundamental flaw in how OpenStack Keystone enforces access control policies when restricted application credentials interact with the EC2 credential creation endpoint.

The core issue lies in the authentication and authorization flow between restricted application credentials and the EC2/S3 compatibility API. When a restricted application credential is used to call the EC2 credential creation API, the system fails to properly propagate the role restrictions from the application credential to the newly created EC2 credential. Instead, the EC2 credential inherits the full permission set of the parent user account.

This represents a significant breakdown in the principle of least privilege, as administrators who configure restricted application credentials expect those restrictions to be enforced across all credential types derived from them.

Root Cause

The root cause of this vulnerability stems from improper authorization enforcement in Keystone's credential management subsystem. When processing EC2 credential creation requests, the system does not adequately validate whether the calling credential has restricted permissions that should be inherited by newly created credentials.

The authorization logic fails to account for the scenario where a restricted application credential is used as the authentication mechanism for creating EC2 credentials. This oversight allows the newly created EC2 credential to bypass the intended role restrictions and inherit the parent user's full S3 permissions instead of the restricted subset.

Attack Vector

The attack requires network access and valid authentication with a restricted application credential. An attacker who has been granted limited access (such as a reader role) through a restricted application credential can exploit this vulnerability through the following attack pattern:

1. The attacker authenticates using their restricted application credential
2. Using that authenticated session, the attacker calls the EC2 credential creation API
3. The newly created EC2 credential is granted the parent user's full S3 permissions
4. The attacker can now use this EC2 credential to perform S3 operations beyond their intended authorization level

This attack is particularly concerning in multi-tenant cloud environments where users may be intentionally granted limited access through restricted application credentials.

Detection Methods for CVE-2026-33551

Indicators of Compromise

• Unexpected EC2 credential creation events from users who should only have restricted application credentials
• S3 API operations being performed by users who should only have reader-level access
• Audit logs showing EC2 credential creation followed by elevated S3 operations from the same user
• Discrepancies between assigned application credential roles and actual S3 operation permissions

Detection Strategies

• Monitor Keystone audit logs for EC2 credential creation API calls made using restricted application credentials
• Implement alerting for S3/EC2 operations that exceed the expected permissions of the originating application credential
• Review EC2 credential metadata to identify credentials that may have been created through restricted application credentials
• Cross-reference EC2 credential creation events with the permission scope of the authenticating credential

Monitoring Recommendations

• Enable detailed Keystone audit logging for credential creation and authentication events
• Configure SIEM rules to correlate application credential restrictions with subsequent EC2 credential permissions
• Implement periodic audits of EC2 credentials to verify permission alignment with intended access policies
• Monitor for unusual patterns of EC2 credential creation, especially from service accounts or automated processes

How to Mitigate CVE-2026-33551

Immediate Actions Required

• Review all deployments using restricted application credentials in combination with EC2/S3 compatibility APIs
• Audit existing EC2 credentials for potential permission elevation
• Consider temporarily disabling EC2 credential creation for restricted application credentials until patches can be applied
• Implement additional monitoring for S3 operations performed by users with restricted credentials

Patch Information

OpenStack has released security patches addressing this vulnerability. Affected organizations should upgrade to the following fixed versions:

• OpenStack Keystone 26.1.1 or later for the 26.x branch
• Patched versions of 27.x, 28.x, and 29.x branches as specified in the OpenStack Security Advisory

Additional technical details are available in the Launchpad Bug Report and the Openwall OSS-Security Discussion.

Workarounds

• Disable EC2 credential creation for users who only require restricted application credential access
• Implement policy rules that prevent EC2 credential creation through restricted application credentials
• Use separate user accounts for EC2/S3 access rather than relying on restricted application credentials
• Deploy network segmentation to limit access to the EC2 credential creation API endpoint

# Example: Restrict EC2 credential creation in policy.json
# Add to /etc/keystone/policy.json to prevent EC2 credential creation
# for users without admin role
"identity:ec2_create_credential": "role:admin or role:service"