Skip to content
OpenAdvisories
High RHSA-2026:39808 3 CVEs

Red Hat Security Advisory: Red Hat OpenStack Services on OpenShift 18.0 (openstack-keystone) security update

Published Jul 16, 2026 · Updated Sep 26, 2026

Ecosystem: Red Hat

Fixed packages 2

ReleasePackageFixed in
Red Hat · OpenStack 18 openstack:18.0::el9 openstack-keystone 1:23.0.3-18.0.20260610133808.9e3dfb4.el9ost
Red Hat · OpenStack 18 openstack:18.0::el9 python3-keystone 1:23.0.3-18.0.20260610133808.9e3dfb4.el9ost

Vulnerabilities 3

  • High 7.9
    CVE-2026-43001

    OpenStack Keystone has an Incorrect Authorization Issue

    An issue was discovered in OpenStack Keystone before 29.0.2. POST /v3/credentials did not validate that the caller-supplied project_id for an EC2-type credential matched the project of the authenticating application credential. This allowed an attacker holdin…

    OpenStack Keystone keystone keystone Debian Ubuntu PyPI
  • High 7.7
    CVE-2026-40683

    OpenStack Keystone: LDAP identity backend does not convert enabled attribute to boolean

    In OpenStack Keystone before 28.0.1, the LDAP identity backend does not convert the user enabled attribute to a boolean when the user_enabled_invert configuration option is False (the default). The _ldap_res_to_model method in the UserApi class only performed…

    OpenStack Keystone keystone keystone Debian Ubuntu PyPI
  • Low 3.5
    CVE-2026-33551

    OpenStack Keystone: Restricted application credentials can create EC2 credentials

    An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0. Restricted application credentials can create EC2 credentials. By using a restricted application credential to call the EC2 credential creation API, an auth…

    OpenStack Keystone keystone keystone Debian Ubuntu PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2451037
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2458472
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2464305
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_39808.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-33551
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-33551
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-33551
  • article
    http://www.openwall.com/lists/oss-security/2026/04/07/12
  • article
    https://security.openstack.org/ossa/OSSA-2026-005.html
  • article
    https://www.openwall.com/lists/oss-security/2026/04/07/12
  • report
    https://access.redhat.com/security/cve/CVE-2026-40683
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-40683
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-40683
  • article
    https://bugs.launchpad.net/keystone/+bug/2121152
  • article
    https://bugs.launchpad.net/keystone/+bug/2141713
  • article
    https://review.opendev.org/958205
  • article
    https://www.openwall.com/lists/oss-security/2026/04/14/9
  • report
    https://access.redhat.com/security/cve/CVE-2026-43001
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-43001
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-43001
  • article
    https://bugs.launchpad.net/keystone/+bug/2149775
  • article
    https://review.opendev.org/c/openstack/keystone/+/985804