Critical Vulnerabilities in OpenStack Keystone Affect Multiple Ubuntu Releases

Critical Vulnerabilities in OpenStack Keystone Affect Multiple Ubuntu Releases

First seen 16 Jun 2026, 23:44 UTC •Ubuntulaunchpad.netLinuxsecurity •95% similarity •70.5

Article Content

Browse articles
ThreatCluster

OpenStack Keystone has been found to have several critical vulnerabilities affecting Ubuntu versions 22.04 LTS, 24.04 LTS, 25.10, and 26.04 LTS. Notably, CVE-2026-33551 allows authenticated attackers with reader roles to bypass application credential restrictions and create EC2 credentials. Another issue, CVE-2026-40683, enables attackers to authenticate as disabled users due to improper LDAP attribute handling. Additional vulnerabilities include CVE-2026-42998, which allows impersonation of other users, and CVE-2026-42999, which permits arbitrary policy attribute injection. These vulnerabilities were disclosed between April and May 2026, with patches available for affected systems. Administrators are advised to update their systems promptly to mitigate these risks.

Key Points: • OpenStack Keystone vulnerabilities affect multiple Ubuntu LTS versions. • CVE-2026-33551 allows role bypass for EC2 credential creation. • Patches are available; immediate updates are recommended.

ThreatCluster AI How this analysis works

Timeline

2026-04-10
CVE-2026-33551 published
OpenStack Keystone vulnerability allows role bypass for EC2 credentials creation.
Ubuntu
2026-04-14
CVE-2026-40683 published
LDAP identity backend flaw allows authentication as disabled users in OpenStack Keystone.
Ubuntu
2026-05-01
CVE-2026-43001 published
New vulnerabilities disclosed in OpenStack Keystone affecting user authentication.
Linuxsecurity
2026-05-28
Multiple CVEs published
CVE-2026-42998, CVE-2026-42999, and CVE-2026-43000 disclosed, highlighting critical security flaws.
Linuxsecurity
2026-05-28
CVE-2026-42999 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-05-28
CVE-2026-43000 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-05-28
CVE-2026-44394 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-05-28
CVE-2026-42998 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-06-16
Patches released for vulnerabilities
Ubuntu releases patches for OpenStack Keystone vulnerabilities; users urged to update systems.
Ubuntu

Extracted Entities

1 / 2

Community

Browse all →

Tracked Entities in This Story

Ubuntu OpenStack OpenStack Keystone