Yaook

By thread

yaook@lists.alasca.cloud

April 2026

1 participants
2 messages

Re: Yaook is at OpenInfra PGT

by Stefan Hoffmann

Hi, I wanted to remind of the yaook session at the OpenInfra PTG on Thursday at 15:00 CEST. Feel free to join and discuss our next steps in the project. If you have topics, add them here[1] link to the session can be fount here[2] Best regards Stefan [1] https://etherpad.opendev.org/p/apr2026-ptg-yaook [2] https://ptg.opendev.org/ptg.html On Tue, 2026-03-24 at 18:12 +0100, Stefan Hoffmann via Yaook wrote: > Hi yaook devs, > > we are invited to take part at the OpenInfra Project Team Gathering. > I planned a session so we can meet and discuss further steps. We will > have a session at 23.04.2026 13-15UTC[1] > > If you have already topics we can talk about, add them to the > etherpad[2] > Meeting link will be [3] > > Best Regards > Stefan > > [1] https://ptg.opendev.org/ptg.html > [2] https://etherpad.opendev.org/p/apr2026-ptg-yaook > [3] https://meetpad.opendev.org/apr2026-ptg-yaook -- Stefan Hoffmann DevOps-Engineer Cloud&Heat Cloud&Heat Technologies GmbH Königsbrücker Straße 96 (Halle 15) | 01099 Dresden +49 351 479 367 36 stefan.hoffmann(a)cloudandheat.com | www.cloudandheat.com Green, Open, Efficient. Ihr Cloud-Service- und Cloud-Technologie-Provider aus Dresden. [1] Commercial Register: District Court Dresden Register Number: HRB 30549 VAT ID No.: DE281093504 Managing Director: Nicolas Röhrs Authorized signatory: Dr. Marius Feldmann [1] Ihr Cloud-Service- und Cloud-Technologie-Provider aus Dresden. https://www.cloudandheat.com/

April 20, 2026

[Security Advisory][CVE-2026-33551] Restricted application credentials can create EC2 credentials

by Stefan Hoffmann

Hi, yesterday OpenStack published a security advisory for keystone. The vulnerability is at Keystone’s EC2 credential creation endpoint. By using a restricted application credential to call the EC2 credential creation API, an authenticated user with only a reader role may obtain an EC2/S3 credential that carries the full set of the parent user’s S3 permissions, effectively bypassing the role restrictions imposed on the application credential. Only deployments that use restricted application credentials in combination with the EC2/S3 compatibility API (swift3 / s3api) are affected. keystone version 3.0.81 has the fixed version. With yaook release 1.4.2 and 2.0.1 this will be also fixed in the pinned_versions of the operators. (still in building) You can patch your keystone with this version pin: values: operator: extraEnv: - name: YAOOK_OP_VERSIONS_OVERRIDE value: | registry.yaook.cloud/yaook/keystone-2025.1: registry.yaook.cloud/yaook/keystone-2025.1:3.0.81 Also see our advisory: https://yaook.cloud/security-advisories-cve-2026-33551 Best regards Stefan -- Stefan Hoffmann DevOps-Engineer Cloud&Heat Cloud&Heat Technologies GmbH Königsbrücker Straße 96 (Halle 15) | 01099 Dresden +49 351 479 367 36 stefan.hoffmann(a)cloudandheat.com | www.cloudandheat.com Green, Open, Efficient. Ihr Cloud-Service- und Cloud-Technologie-Provider aus Dresden. [1] Commercial Register: District Court Dresden Register Number: HRB 30549 VAT ID No.: DE281093504 Managing Director: Nicolas Röhrs Authorized signatory: Dr. Marius Feldmann [1] Ihr Cloud-Service- und Cloud-Technologie-Provider aus Dresden. https://www.cloudandheat.com/

April 8, 2026