CVE-2026-33551 OpenStack CVE debrief

Who should care

OpenStack Keystone administrators and users with restricted application credentials should assess exposure and verify affected versions. This includes reviewing system configurations, validating credential usage, and ensuring appropriate security measures are in place to mitigate potential unauthorized S3 access.

Why it matters

CVE-2026-33551 allows an authenticated user with a reader role to create EC2/S3 credentials with full S3 permissions, effectively bypassing role restrictions in OpenStack Keystone. Defenders should prioritize verifying affected versions, restricting application credential usage, and monitoring for suspicious activity.

• Potential unauthorized S3 access with elevated permissions
• Role restrictions bypassed for EC2/S3 credential creation
• Need for verification of affected OpenStack Keystone versions
• Possible lateral movement or privilege escalation

Technical summary

The issue allows an authenticated user with a reader role to create EC2/S3 credentials with full S3 permissions using a restricted application credential, bypassing role restrictions in OpenStack Keystone versions 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0. This occurs due to the improper handling of restricted application credentials in combination with the EC2/S3 compatibility API (swift3 / s3api). Defenders should prioritize verifying affected OpenStack Keystone versions and restricting application credential usage.

Defensive priority

Defenders should prioritize verifying affected OpenStack Keystone versions and restricting application credential usage.

Recommended defensive actions

• Verify OpenStack Keystone version and check for affected versions
• Restrict application credential usage with EC2/S3 compatibility API
• Monitor for suspicious EC2/S3 credential creation activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in OpenStack Keystone versions 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0. The vulnerability allows an authenticated user with a reader role to create EC2/S3 credentials with full S3 permissions using a restricted application credential, bypassing role restrictions. Evidence is limited to public CVE and NVD records, with no additional claims or exploit details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.