Introduction
Attackers can impersonate OpenStack cloud users and gain unauthorized access to cloud resources by replaying AWS signatures from presigned URLs. The flaw is in OpenStack Keystone, the identity service behind many private and public cloud deployments. It directly affects organizations that rely on EC2- or S3-compatible APIs for automation, storage, or registry integration.
OpenStack is a leading open-source cloud infrastructure platform that runs clouds for enterprises, service providers, and research institutions worldwide. Keystone, its identity service, handles authentication and authorization for every OpenStack component. OpenStack's scale and its place in the cloud ecosystem make a Keystone vulnerability especially serious.
Technical Information
CVE-2025-65073 is a high-severity authorization bypass in OpenStack Keystone's EC2 and S3 token endpoints. The flaw is present in Keystone versions before 26.0.1, 27.0.0, and 28.0.0. The problem lies in how the /v3/ec2tokens and /v3/s3tokens endpoints process AWS Signature Version 4 credentials.
When a request to these endpoints carries a valid AWS signature, such as the one embedded in a presigned S3 URL, Keystone validates the signature and may grant authorization without checking that the requester holds the AWS secret access key. The endpoints do not run enough pre-authentication checks before they validate the signature. Anyone with a valid presigned URL can therefore replay its signature to Keystone and get a fully scoped token from ec2tokens, or project and scope information from s3tokens, for the associated account.
The root cause is an incorrect authorization check (CWE-863) that allows signature replay attacks. The ec2tokens endpoint is the more dangerous of the two, because it can issue a full Keystone token with all associated permissions. The s3tokens endpoint leaks metadata about account scope and project associations, which can help an attacker with further attacks. The presigned URL's TTL limits the attack window for ec2tokens, but s3tokens may leak information even after the URL expires.
Public sources do not include any vulnerable code snippets. The official advisory and the Launchpad bug report discuss the exploit details.
Affected Systems and Versions
- OpenStack Keystone versions before 26.0.1
- OpenStack Keystone 27.0.0
- OpenStack Keystone 28.0.0
Any deployment that exposes the /v3/ec2tokens or /v3/s3tokens endpoints and uses EC2 credentials is at risk. That includes setups that generate presigned URLs for S3-compatible storage or registry integrations.
Vendor Security History
OpenStack Keystone has had similar issues before. CVE-2020-12692 was a weakness in signature TTL validation in the EC2 API that let attackers reuse authorization headers. The OpenStack project runs an active security response process and coordinates advisories and patches across supported versions. Even so, the repeated problems in external authentication handling point to ongoing complexity and risk in these components.
