Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0. Restricted application credentials can create EC2 credentials. By using a restricted application credential to call the EC2 credential creation API, an authenticated user with only a reader role may obtain an EC2/S3 credential that carries the full set of the parent user's S3 permissions, effectively bypassing the role restrictions imposed on the application credential. Only deployments that use restricted application credentials in combination with the EC2/S3 compatibility API (swift3 / s3api) are affected.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
3 versions affected across 1 product
| Date | Total | Labels |
|---|
| 2026-04-10 | 2 | Disclosure1General1 |
| 2026-04-11 | 1 | General1 |
| 2026-06-17 | 1 | Disclosure1 |
CVE-2026-33551 An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0. Restricted application credentials can create EC2 credentials. … https://www.cve.org/CVERecord?id=CVE-2026-33551
Post summary
The notice highlights a newly discovered issue in OpenStack Keystone that allows restricted application credentials to create EC2 credentials, with no further detail on exploitation or mitigation.
Ubuntu reported four OpenStack Keystone flaws, including CVE-2026-33551 and CVE-2026-40683, affecting Ubuntu 22.04, 24.04, 25.10 and 26.04 and allowing role bypass, disabled-user logins and user impersonation. https://threatcluster.io/cluster/critical-vulnerabilities-in-openstack-keystone-affect-multip-1d521921
Post summary
Ubuntu announced four OpenStack Keystone vulnerabilities (CVE-2026-33551 & CVE-2026-40683) affecting multiple Ubuntu releases, enabling role bypass, disabled‑user logins, and user impersonation.
⚡ New CVE Alert: CVE-2026-33551 📊 Severity: 3.5 🚨 Risk Level: Low 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-33551 #CVE-2026-33551 #CVE #Low #CyberSecurity #InfoSec https://t.co/Bh2C2VsaU2
Post summary
The tweet announces CVE-2026-33551 as a low‑severity vulnerability but supplies no exploitation details, PoC, or mitigation information.
CVE-2026-33551 Privilege Escalation in OpenStack Keystone via Restricted Application Credentials https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-33551
Post summary
The text merely references CVE-2026-33551 with a link to vulnerability details but provides no additional information on PoC, exploits, patches, or active usage.
4 of 4 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openstack | keystone | - | - | - |
| App | openstack | keystone | 27.0.0 | - | - |
| App | openstack | keystone | 28.0.0 | - | - |
| App | openstack | keystone | 29.0.0 | - | - |