Skip to content

Fix typos. #357

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
garloff wants to merge 1 commit into
base: main
Choose a base branch
from
+4 −3
Draft

Fix typos. #357

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 4 additions & 3 deletions blog/2026-04-08-cve-2026-33551.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,15 +32,15 @@ This is typically the case for SCS clouds, as S3 compatibility is a requirement.

While creating AppCreds with roles with lower privileges is not a very common
use case, it is supported by OpenStack clouds and is actually a good practice
to limit the privileges of running coponents or the delegated privileges for
to limit the privileges of running components or the delegated privileges for
human bearers of the AppCred. The fact that EC2 credentials can be used to
work around an regain the privileges of the user who created the original
work around and regain the privileges of the user who created the original
AppCred is a serious issue, as it breaks the principle of least privileges
and may weaken or break security models for applications or delegated
authorizations.

Note that this vulnerability does not allow to escalate privileges further
than the original AppCred creators privileges and does require the attacker
than the original AppCred creator's privileges and does require the attacker
to get access to the limited AppCred in the first place.

## Embargo
Expand Down Expand Up @@ -88,4 +88,5 @@ SCS security contact is [security@scs.community](mailto:security@scs.community),

## Version history

- Typo fixes and yaook link, v1.0, 2026-04-09, xx:xx CEST
- Initial draft, v0,9, 2026-04-08, 13:45 CEST
Loading