Skip to content
Critical Vulnerabilities in OpenStack Keystone Affect Multiple Ubuntu Releases

Critical Vulnerabilities in OpenStack Keystone Affect Multiple Ubuntu Releases

First seen 16 Jun 2026, 23:44 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •June 17, 2026 at 23:15 UTC
  • •OpenStack Keystone vulnerabilities affect multiple Ubuntu LTS versions.
  • •CVE-2026-33551 allows role bypass for EC2 credential creation.
  • •Patches are available; immediate updates are recommended.

OpenStack Keystone has been found to have several critical vulnerabilities affecting Ubuntu versions 22.04 LTS, 24.04 LTS, 25.10, and 26.04 LTS. Notably, CVE-2026-33551 allows authenticated attackers with reader roles to bypass application credential restrictions and create EC2 credentials. Another issue, CVE-2026-40683, enables attackers to authenticate as disabled users due to improper LDAP attribute handling. Additional vulnerabilities include CVE-2026-42998, which allows impersonation of other users, and CVE-2026-42999, which permits arbitrary policy attribute injection. These vulnerabilities were disclosed between April and May 2026, with patches available for affected systems. Administrators are advised to update their systems promptly to mitigate these risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 94d ago How this analysis works

Timeline

2026-04-10
CVE-2026-33551 published
OpenStack Keystone vulnerability allows role bypass for EC2 credentials creation.
Ubuntu
2026-04-14
CVE-2026-40683 published
LDAP identity backend flaw allows authentication as disabled users in OpenStack Keystone.
Ubuntu
2026-05-01
CVE-2026-43001 published
New vulnerabilities disclosed in OpenStack Keystone affecting user authentication.
Linuxsecurity
2026-05-28
Multiple CVEs published
CVE-2026-42998, CVE-2026-42999, and CVE-2026-43000 disclosed, highlighting critical security flaws.
Linuxsecurity
2026-05-28
CVE-2026-42999 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-05-28
CVE-2026-43000 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-05-28
CVE-2026-44394 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-05-28
CVE-2026-42998 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-06-16
Patches released for vulnerabilities
Ubuntu releases patches for OpenStack Keystone vulnerabilities; users urged to update systems.
Ubuntu

More articles in this cluster (3)

Following this threat?

Track Ubuntu and CVE-2026-33551 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (12)

1 / 3