Skip to content
OpenAdvisories
High RHSA-2026:28044 3 CVEs

Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (openstack-keystone) security update

Published Jun 23, 2026 · Updated Sep 26, 2026

Ecosystem: Red Hat

Fixed packages 12

ReleasePackageFixed in
Red Hat · OpenStack 17 openstack:17.1::el9 openstack-keystone 1:19.0.2-17.1.20260529190847.54dd95d.el9ost
Red Hat · OpenStack 17 openstack:17.1::el9 openstack-swift 0:2.27.1-17.1.20231004180819.el9ost
Red Hat · OpenStack 17 openstack:17.1::el9 openstack-swift-account 0:2.27.1-17.1.20231004180819.el9ost
Red Hat · OpenStack 17 openstack:17.1::el9 openstack-swift-container 0:2.27.1-17.1.20231004180819.el9ost
Red Hat · OpenStack 17 openstack:17.1::el9 openstack-swift-object 0:2.27.1-17.1.20231004180819.el9ost
Red Hat · OpenStack 17 openstack:17.1::el9 openstack-swift-proxy 0:2.27.1-17.1.20231004180819.el9ost
Red Hat · OpenStack 17 openstack:17.1::el9 openstack-tempest 1:33.0.0-17.1.20260406141650.1580f6f.el9ost
Red Hat · OpenStack 17 openstack:17.1::el9 openstack-tempest-all 1:33.0.0-17.1.20260406141650.1580f6f.el9ost
Red Hat · OpenStack 17 openstack:17.1::el9 python3-keystone 1:19.0.2-17.1.20260529190847.54dd95d.el9ost
Red Hat · OpenStack 17 openstack:17.1::el9 python3-swift 0:2.27.1-17.1.20231004180819.el9ost
Red Hat · OpenStack 17 openstack:17.1::el9 python3-tempest 1:33.0.0-17.1.20260406141650.1580f6f.el9ost
Red Hat · OpenStack 17 openstack:17.1::el9 python3-tempest-tests 1:33.0.0-17.1.20260406141650.1580f6f.el9ost

Vulnerabilities 3

  • High 7.9
    CVE-2026-43001

    OpenStack Keystone has an Incorrect Authorization Issue

    An issue was discovered in OpenStack Keystone before 29.0.2. POST /v3/credentials did not validate that the caller-supplied project_id for an EC2-type credential matched the project of the authenticating application credential. This allowed an attacker holdin…

    OpenStack Keystone keystone keystone Debian Ubuntu PyPI
  • High 7.5
    CVE-2025-65073

    OpenStack Keystone allows /v3/ec2tokens or /v3/s3tokens request with valid AWS Signature to provide Keystone authorization.

    OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Signature to provide Keystone authorization.

    OpenStack Keystone keystone keystone Debian Ubuntu PyPI
  • Low 3.5
    CVE-2026-33551

    OpenStack Keystone: Restricted application credentials can create EC2 credentials

    An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0. Restricted application credentials can create EC2 credentials. By using a restricted application credential to call the EC2 credential creation API, an auth…

    OpenStack Keystone keystone keystone Debian Ubuntu PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2415344
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2451037
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_28044.json
  • report
    https://access.redhat.com/security/cve/CVE-2025-65073
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-65073
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-65073
  • article
    https://security.openstack.org/ossa/OSSA-2025-002.html
  • article
    https://www.openwall.com/lists/oss-security/2025/11/04/2
  • report
    https://access.redhat.com/security/cve/CVE-2026-33551
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-33551
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-33551
  • article
    http://www.openwall.com/lists/oss-security/2026/04/07/12
  • article
    https://security.openstack.org/ossa/OSSA-2026-005.html
  • article
    https://www.openwall.com/lists/oss-security/2026/04/07/12
  • report
    https://access.redhat.com/security/cve/CVE-2026-43001
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2464305
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-43001
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-43001
  • article
    https://bugs.launchpad.net/keystone/+bug/2149775
  • article
    https://review.opendev.org/c/openstack/keystone/+/985804