Back Linuxsecurity

Ubuntu OpenStack Keystone Critical Roles Bypass Vulnern USN-8433

Linuxsecurity •LinuxSecurity Advisories • June 16, 2026

A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 26.04 LTS - Ubuntu 25.10 - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS Summary: Several security issues were fixed in OpenStack Keystone. Software Description: - keystone: OpenStack identity service Details: It was discovered that OpenStack Keystone allowed restricted application credentials to create EC2 credentials. An authenticated attacker with only a reader role could possibly use this issue to bypass the role restrictions imposed on the application credential. (CVE-2026-33551) It was discovered that the OpenStack Keystone LDAP identity backend did not correctly convert the user enabled attribute to a boolean value. An attacker could possibly use this issue to authenticate as a user disabled in LDAP. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 25.10. (CVE-2026-40683) It was discovered that OpenStack Keystone's application credential authentication plugin did not verify t...

The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS keystone 2:29.0.0-0ubuntu1.2 keystone-common 2:29.0.0-0ubuntu1.2 keystone-doc 2:29.0.0-0ubuntu1.2 python3-keystone 2:29.0.0-0ubuntu1.2 Ubuntu 25.10 keystone 2:28.0.0-0ubuntu1.3 keystone-common 2:28.0.0-0ubuntu1.3 keystone-doc 2:28.0.0-0ubuntu1.3 python3-keystone 2:28.0.0-0ubuntu1.3 Ubuntu 24.04 LTS keystone 2:25.0.0-0ubuntu1.4 keystone-common 2:25.0.0-0ubuntu1.4 keystone-doc 2:25.0.0-0ubuntu1.4 python3-keystone 2:25.0.0-0ubuntu1.4 Ubuntu 22.04 LTS keystone 2:21.0.1-0ubuntu2.4 keystone-common 2:21.0.1-0ubuntu2.4 keystone-doc 2:21.0.1-0ubuntu2.4 python3-keystone 2:21.0.1-0ubuntu2.4 In general, a standard system update will make all the necessary changes.

CVE-2026-33551, CVE-2026-40683, CVE-2026-42998, CVE-2026-42999,

CVE-2026-43000, CVE-2026-43001, CVE-2026-44394

Ubuntu Security Notice USN-8433-1

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in OpenStack Keystone Affect Multiple Ubuntu Releases OpenStack Keystone has been found to have several critical vulnerabilities affecting Ubuntu versions 22.04 LTS, 24.04 LTS, 25.10, and 26.04 LTS. Notably, CVE-2026-33551 allows authenticated attackers with reader roles to bypass application credential restrictions and create EC2 credentials. Another issue, CVE-2026-40683, enables attackers to authenticate as disabled users due to improper LDAP attribute handling. Additional vulnerabilities include CVE-2026-42998, which allows impersonation of other users, and CVE-2026-42999, which permits arbitrary policy attribute injection. These vulnerabilities were disclosed between April and May 2026, with patches available for affected systems. Administrators are advised to update their systems promptly to mitigate these risks. 2 sources 71

Extracted Entities

Ubuntu OpenStack Keystone Critical Roles Bypass Vulnern USN-8433

The full story

Extracted Entities

Companies (1)

CVEs (7)

Platforms (1)