Description
OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Signature to provide Keystone authorization.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpenStack | Keystone | < 26.0.1, 27.0.0, 28.0.0 | 26.0.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | keystone | 2:28.0.0-2 | — |
| Debian 13 | keystone | 2:27.0.0-3+deb13u1 | DSA-6056-1 |
| Debian 12 | keystone | 2:22.0.2-0+deb12u1 | DSA-6056-1 |
| Debian 11 | keystone | 2:18.1.0-1+deb11u2 | DLA-4367-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | heat | No fix yet | — |
| Ubuntu 26.04 LTS | heat | No fix yet | — |
| Ubuntu 26.04 LTS | keystone | 2:28.0.0-0ubuntu2 | — |
| Ubuntu 25.10 | heat | No fix yet | — |
| Ubuntu 25.10 | keystone | 2:28.0.0-0ubuntu1.1 | — |
| Ubuntu 25.10 | swift | 2.36.0-0ubuntu1.1 | — |
| Ubuntu 24.04 LTS | heat | No fix yet | — |
| Ubuntu 24.04 LTS | keystone | 2:25.0.0-0ubuntu1.1 | — |
| Ubuntu 24.04 LTS | swift | 2.33.0-0ubuntu1.1 | — |
| Ubuntu 22.04 LTS | heat | No fix yet | — |
| Ubuntu 22.04 LTS | keystone | 2:21.0.1-0ubuntu2.1 | USN-7926-1 |
| Ubuntu 22.04 LTS | swift | 2.29.2-0ubuntu1.1 | — |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | heat +1 | No fix yet | — |
| Ubuntu 18.04 LTS | heat +1 | No fix yet | — |
| Ubuntu 16.04 LTS | heat +1 | No fix yet | — |
| Ubuntu Pro 20.04 LTS | keystone | No fix yet | — |
| Ubuntu Pro 18.04 LTS | keystone | No fix yet | — |
| Ubuntu Pro 16.04 LTS | keystone | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 18 | python3-keystone +1 | 1:23.0.3-18.0.20241202141842.9e3dfb4.el9ost | RHSA-2026:1958 |
| Red Hat OpenStack 17 | python3-keystone +1 | 1:19.0.2-17.1.20260529190847.54dd95d.el9ost | RHSA-2026:28044 |
| Red Hat OpenStack 17 | python3-swift +5 | 2.27.1-17.1.20231004180819.el9ost | RHSA-2026:28044 |
| Red Hat OpenStack 17 | python3-tempest +3 | 1:33.0.0-17.1.20260406141650.1580f6f.el9ost | RHSA-2026:28044 |
| Red Hat OpenStack 16 | collectd-sensubility | 0.2.1-1.1.el8ost | RHSA-2026:54757 |
| Red Hat OpenStack 16 | erlang +20 | 23.3.4.18-2.el8ost | RHSA-2026:54757 |
| Red Hat OpenStack 16 | etcd | 3.3.23-22.el8ost | RHSA-2026:54757 |
| Red Hat OpenStack 16 | python-oslo-messaging +1 | 10.2.4-2.20260710155333.82281a0.el8ost | RHSA-2026:54757 |
| Red Hat OpenStack 16 | python-pyasn1 +2 | 0.4.6-4.el8ost | RHSA-2026:54757 |
| Red Hat OpenStack 16 | python3-glance +1 | 1:19.0.5-2.20260512165254.eb6ad61.el8ost | RHSA-2026:54757 |
| Red Hat OpenStack 16 | python3-keystone +1 | 1:16.0.3-2.20260616134936.9d699a7.el8ost | RHSA-2026:54757 |
| Red Hat OpenStack 16 | python3-nova +11 | 1:20.6.2-2.20260317135026.8a24acd.el8ost | RHSA-2026:54757 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | keystone | < 26.0.1 | 26.0.1 | GHSA-hcqg-5g63-7j9h |
| PyPI | keystone | >= 27.0.0.0rc1, < 27.0.0 | 27.0.0 | GHSA-hcqg-5g63-7j9h |
| PyPI | keystone | >= 28.0.0.0rc1, < 28.0.0 | 28.0.0 | GHSA-hcqg-5g63-7j9h |
| PyPI | keystone | < 26.0.1 · >= 27.0.0.0rc1, < 27.0.0 · >= 28.0.0.0rc1, < 28.0.0 | 26.0.1, 27.0.0, 28.0.0 | PYSEC-2026-1490 |
Advisories 7
- RHSA-2026:54757 Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 security advisory Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:28044 Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (openstack-keystone) security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
- RHSA-2026:1958 Red Hat Security Advisory: Red Hat OpenStack Services on OpenShift 18.0 (openstack-keystone) security update Red Hat Security Advisories (RHSA) · Aug 14, 2026
- WID-SEC-2026-0408 Red Hat OpenStack Services auf OpenShift (python-eventlet, keystone): Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 13, 2026
- USN-7926-1 keystone vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- DSA-6056-1 keystone - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-4367-1 keystone - security update Debian Security (DSA / DLA) · Mar 9, 2026