Ubuntu USN · USN-8433-1

OpenStack Keystone vulnerabilities

Published: Tue, 16 Jun 2026 13:45

CVE-2026-44394CVE-2026-33551CVE-2026-43000CVE-2026-42998CVE-2026-43001CVE-2026-42999CVE-2026-40683

Summary

Several security issues were fixed in OpenStack Keystone.

Details

It was discovered that OpenStack Keystone allowed restricted application credentials to create EC2 credentials. An authenticated attacker with only a reader role could possibly use this issue to bypass the role restrictions imposed on the application credential. (CVE-2026-33551) It was discovered that the OpenStack Keystone LDAP identity backend did not correctly convert the user enabled attribute to a boolean value. An attacker could possibly use this issue to authenticate as a user disabled in LDAP. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 25.10. (CVE-2026-40683) It was discovered that OpenStack Keystone's application credential authentication plugin did not verify that the user supplied in an authentication request matched the credential owner. An authenticated attacker could possibly impersonate another user and gain access to their tokens and credentials. (CVE-2026-42998) It was discovered that OpenStack Keystone's RBAC policy enforcer unconditionally merged the raw JSON request body into the policy enforcement dictionary, overwriting trusted target data. An authenticated attacker could possibly use this issue to inject arbitrary policy attributes to bypass RBAC checks. (CVE-2026-42999) It was discovered that OpenStack Keystone allowed an attacker with the member role to escalate privileges to admin by chaining application credential impersonation with Keystone trusts. An attacker could possibly use this issue to create a persistent trust delegating the victim's admin role to themselves. (CVE-2026-43000) It was discovered that OpenStack Keystone did not validate that the project_id for an EC2 credential matched the project of the authenticating application credential. An attacker with valid credentials for one project could possibly use this issue to create EC2 credentials targeting a different project. (CVE-2026-43001) It was discovered that OpenStack Keystone's federated token rescoping mechanism did not propagate the original token's expiry to the newly issued token. A remote attacker could possibly use this issue to maintain access indefinitely by repeatedly rescoping tokens before expiry. (CVE-2026-44394)

Recommended actions per Ubuntu release

StackPatch playbook auto-generated per release codename and per affected package.

Ubuntu jammy

keystone→2:21.0.1-0ubuntu2.4apt_upgrade
Standard apt upgrade. Install 2:21.0.1-0ubuntu2.4 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y keystone
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
keystone→2:21.0.1-0ubuntu2.4apt_upgrade
Standard apt upgrade. Install 2:21.0.1-0ubuntu2.4 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y keystone
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
keystone-common→2:21.0.1-0ubuntu2.4apt_upgrade
Standard apt upgrade. Install 2:21.0.1-0ubuntu2.4 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y keystone-common
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
keystone-doc→2:21.0.1-0ubuntu2.4apt_upgrade
Standard apt upgrade. Install 2:21.0.1-0ubuntu2.4 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y keystone-doc
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
python3-keystone→2:21.0.1-0ubuntu2.4apt_upgrade
Standard apt upgrade. Install 2:21.0.1-0ubuntu2.4 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y python3-keystone
```
Most apt upgrades restart their service automatically. needrestart lists anything else.

Ubuntu noble

keystone→2:25.0.0-0ubuntu1.4apt_upgrade
Standard apt upgrade. Install 2:25.0.0-0ubuntu1.4 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y keystone
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
keystone→2:25.0.0-0ubuntu1.4apt_upgrade
Standard apt upgrade. Install 2:25.0.0-0ubuntu1.4 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y keystone
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
keystone-common→2:25.0.0-0ubuntu1.4apt_upgrade
Standard apt upgrade. Install 2:25.0.0-0ubuntu1.4 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y keystone-common
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
keystone-doc→2:25.0.0-0ubuntu1.4apt_upgrade
Standard apt upgrade. Install 2:25.0.0-0ubuntu1.4 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y keystone-doc
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
python3-keystone→2:25.0.0-0ubuntu1.4apt_upgrade
Standard apt upgrade. Install 2:25.0.0-0ubuntu1.4 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y python3-keystone
```
Most apt upgrades restart their service automatically. needrestart lists anything else.

Ubuntu questing

keystone→2:28.0.0-0ubuntu1.3apt_upgrade
Standard apt upgrade. Install 2:28.0.0-0ubuntu1.3 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y keystone
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
keystone→2:28.0.0-0ubuntu1.3apt_upgrade
Standard apt upgrade. Install 2:28.0.0-0ubuntu1.3 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y keystone
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
keystone-common→2:28.0.0-0ubuntu1.3apt_upgrade
Standard apt upgrade. Install 2:28.0.0-0ubuntu1.3 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y keystone-common
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
keystone-doc→2:28.0.0-0ubuntu1.3apt_upgrade
Standard apt upgrade. Install 2:28.0.0-0ubuntu1.3 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y keystone-doc
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
python3-keystone→2:28.0.0-0ubuntu1.3apt_upgrade
Standard apt upgrade. Install 2:28.0.0-0ubuntu1.3 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y python3-keystone
```
Most apt upgrades restart their service automatically. needrestart lists anything else.

Ubuntu resolute

keystone→2:29.0.0-0ubuntu1.2apt_upgrade
Standard apt upgrade. Install 2:29.0.0-0ubuntu1.2 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y keystone
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
keystone→2:29.0.0-0ubuntu1.2apt_upgrade
Standard apt upgrade. Install 2:29.0.0-0ubuntu1.2 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y keystone
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
keystone-common→2:29.0.0-0ubuntu1.2apt_upgrade
Standard apt upgrade. Install 2:29.0.0-0ubuntu1.2 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y keystone-common
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
keystone-doc→2:29.0.0-0ubuntu1.2apt_upgrade
Standard apt upgrade. Install 2:29.0.0-0ubuntu1.2 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y keystone-doc
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
python3-keystone→2:29.0.0-0ubuntu1.2apt_upgrade
Standard apt upgrade. Install 2:29.0.0-0ubuntu1.2 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y python3-keystone
```
Most apt upgrades restart their service automatically. needrestart lists anything else.

Are YOU affected by USN-8433-1?

5-second check on your actual server. Reads /etc/os-release, uname -r, and dpkg-query; matches against the live USN + Debian Security Tracker feeds; tells you whether USN-8433-1 (and any other live CVE) applies. Anonymous, no signup.

curl https://mindsparkstack.com/scan.sh | bash

Form-based quickscan Read the bash source first

Want this automated for your servers?

StackPatch runs this match against YOUR installed packages every hour

Free 1-server / $99 lifetime founder seat (50 only) / $19+/mo monthly. Indie pricing.

Buy lifetime →See StackPatch →Live audit log →