CVE-2026-33551: 
NixOS vulnerability analysis and mitigation

CVE-2026-33551 is an incorrect authorization vulnerability in OpenStack Keystone that allows authenticated users with restricted application credentials to bypass role restrictions by creating EC2/S3 credentials with elevated permissions. It affects Keystone versions 14.0.0 through 26 (before 26.1.1), as well as versions 27.0.0, 28.0.0, and 29.0.0. The vulnerability was reported by Maxence Bornecque from Orange Cyberdefense CERT and disclosed on April 7, 2026 via the oss-security mailing list, with the CVE published on April 10, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) per NVD, or 3.5 (Low) per GitHub Advisory (Github Advisory, Openwall).

The root cause is CWE-863 (Incorrect Authorization): Keystone's EC2 credential creation API endpoint does not properly enforce the role restrictions associated with restricted application credentials. When a restricted application credential (which may carry only a reader role) is used to call the EC2 credential creation API, Keystone incorrectly issues EC2/S3 credentials that inherit the full set of the parent user's S3 permissions rather than the restricted credential's limited roles. This attack requires network access and low-level authenticated privileges, but has high attack complexity. Only deployments combining restricted application credentials with the EC2/S3 compatibility API (swift3/s3api) are affected (Openwall, Github Advisory).

A successful exploit allows an authenticated user with only a reader role to obtain EC2/S3 credentials carrying the full S3 permissions of the parent user account, effectively escalating their access to cloud object storage resources. This is a confidentiality and integrity concern for S3-compatible storage (via swift3/s3api), potentially enabling unauthorized data access, exfiltration, or modification of objects the attacker should not have access to. Availability is not directly impacted, and the scope is limited to deployments using the EC2/S3 compatibility API with restricted application credentials (Github Advisory, Openwall).

No public proof-of-concept exploit code has been identified, and there is no confirmed evidence of in-the-wild exploitation as of the time of reporting. The Launchpad bug report (https://bugs.launchpad.net/keystone/+bug/2142138) is the primary reference for the issue but is classified as an advisory rather than an exploit. The EPSS score is approximately 0.02–0.031%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory, Openwall).

1. Reconnaissance: Identify an OpenStack deployment running a vulnerable version of Keystone (14.0.0–26.x before 26.1.1, or exactly 27.0.0, 28.0.0, 29.0.0) that has the EC2/S3 compatibility API (swift3/s3api) enabled.
2. Obtain restricted application credential: As an authenticated user with a reader role, create or obtain a restricted application credential that has limited role assignments (e.g., reader-only).
3. Call EC2 credential creation API: Use the restricted application credential to authenticate and call the Keystone EC2 credential creation API endpoint (POST /v3/users/{user_id}/credentials/OS-EC2).
4. Receive elevated EC2/S3 credentials: Due to the authorization bypass, Keystone returns EC2/S3 credentials that carry the full set of the parent user's S3 permissions, not the restricted reader role.
5. Access S3 resources: Use the obtained EC2/S3 credentials with an S3-compatible client (e.g., AWS CLI, s3cmd) against the swift3/s3api endpoint to access, read, or modify S3 objects beyond the intended authorization scope (Openwall, Github Advisory).

• Logs: Keystone API logs showing POST /v3/users/{user_id}/credentials/OS-EC2 requests authenticated with restricted application credentials (identifiable by application_credential token type), especially from users with reader-only roles.
• Logs: Unexpected EC2 credential creation events in Keystone audit logs for users whose role assignments should not permit broad S3 access.
• Network: S3/swift3 API requests using EC2 credentials associated with accounts that should only have reader-level access, particularly accessing or modifying resources beyond their expected scope.
• Logs: Swift or s3api access logs showing object reads or writes by credentials linked to restricted application credentials.

Upgrade OpenStack Keystone to patched versions: 26.1.1 (for the 26.x branch), 27.1.0, 28.1.0, or 29.1.0 or later. Patches are also available for specific OpenStack release branches (caracal, dalmatian, epoxy, flamingo, gazpacho, hibiscus) via the OpenDev review links provided in the advisory. For deployments unable to patch immediately, consider auditing and restricting the use of restricted application credentials in combination with the EC2/S3 compatibility API, or temporarily disabling EC2 credential creation for restricted application credentials. Debian LTS and stable packages have also received updates (Openwall, Github Advisory).

The vulnerability was responsibly disclosed by Maxence Bornecque from Orange Cyberdefense CERT Vulnerability Intelligence Watch Team and coordinated through the OpenStack Vulnerability Management Team. The OpenStack security team published OSSA-2026-005 and provided patches across multiple active release branches. Debian issued security advisories (DLA-4611-1 and DSA-6331-1) for the keystone package, and the issue was picked up by Linux security news aggregators. No significant social media controversy or broad community debate has been observed beyond standard patch notification channels (Openwall, Github Advisory).