OpenStack Keystone versions 14 to 26 (before 26.1.1), 27.0.0, 28.0.0, and 29.0.0 contain an authorization flaw (CWE-863) where restricted application credentials can be used to create EC2 credentials that inherit the full S3 permissions of the parent user. This bypasses the role restrictions intended for the application credential. The vulnerability specifically impacts deployments using restricted application credentials with the EC2/S3 compatibility API (swift3 / s3api). The CVSS v3.1 score is 3.5 (low severity), reflecting low impact and high attack complexity. The vulnerability is present in a cloud service context, and the vendor manages remediation.

An authenticated user with only a reader role can exploit this vulnerability to obtain EC2/S3 credentials that carry the full permissions of the parent user, effectively bypassing role restrictions. This could lead to unauthorized privilege escalation within the affected OpenStack Keystone deployments that use the EC2/S3 compatibility API. There is no impact on confidentiality, but integrity is affected due to unauthorized actions possible with elevated permissions. Availability is not impacted. No known exploits are reported in the wild.

Since OpenStack Keystone is a cloud service, the vendor manages remediation server-side. A patch is available, and users should verify with the OpenStack vendor advisory for the latest remediation status and ensure their deployments are updated to versions 26.1.1 or later, or 27.0.0, 28.0.0, 29.0.0 and beyond as applicable. Deployments not using restricted application credentials with the EC2/S3 compatibility API are not affected. No additional action is required beyond applying the vendor-managed patch or update.