Openstack Keystone
46 CVEs affecting Openstack Keystone. Latest disclosed: 2026-05-28. Critical: 0, High: 11.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-12691 | High | 8.8 | 2020-05-07 | An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any authenticated user can create an EC2 credential for themselves for a project that… |
CVE-2020-12690 | High | 8.8 | 2020-05-07 | An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when… |
CVE-2020-12689 | High | 8.8 | 2020-05-07 | An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any user authenticated within a limited scope (trust/oauth/application credential) can… |
CVE-2019-19687 | High | 8.8 | 2019-12-09 | OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials… |
CVE-2026-43001 | High | 7.9 | 2026-05-01 | An issue was discovered in OpenStack Keystone before 29.0.2. POST /v3/credentials did not validate that the caller-supplied project_id for an EC2-type credenti… |
CVE-2026-40683 | High | 7.7 | 2026-04-14 | In OpenStack Keystone before 28.0.1, the LDAP identity backend does not convert the user enabled attribute to a boolean when the user_enabled_invert configurat… |
CVE-2025-65073 | High | 7.5 | 2025-11-17 | OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Signature to provide Keystone authorizatio… |
CVE-2021-38155 | High | 7.5 | 2021-08-06 | OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclosure during account… |
CVE-2012-1572 | High | 7.5 | 2019-11-12 | OpenStack Keystone: extremely long passwords can crash Keystone by exhausting stack space |
CVE-2015-7546 | High | 7.5 | 2016-02-03 | The identity service in OpenStack Identity (Keystone) before 2015.1.3 (Kilo) and 8.0.x before 8.0.2 (Liberty) and keystonemiddleware (formerly python-keystonec… |
CVE-2021-3563 | High | 7.4 | 2022-08-26 | A flaw was found in openstack-keystone. Only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity w… |
CVE-2022-2447 | Medium | 6.6 | 2022-09-01 | A flaw was found in Keystone. There is a time lag (up to one hour in a default configuration) between when security policy says a token should be revoked from… |
CVE-2013-0270 | Medium | 6.5 | 2013-04-12 | A flaw was found in OpenStack Keystone. A remote attacker could exploit this vulnerability by sending a large HTTP request, specifically by providing a long te… |
CVE-2026-44394 | Medium | 6.0 | 2026-05-28 | An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone federated token rescoping mechanism does not propagate the original token's expiry to… |
CVE-2026-43000 | Medium | 6.0 | 2026-05-28 | An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation vulnerability, an attacker with the mem… |
CVE-2026-42999 | Medium | 6.0 | 2026-05-28 | An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone RBAC policy enforcer in enforce_call unconditionally merges the raw JSON request body… |
CVE-2026-42998 | Medium | 6.0 | 2026-05-28 | An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone application credential authentication plugin does not verify that the user supplied i… |
CVE-2013-2255 | Medium | 5.9 | 2019-11-01 | HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side SSL certificates. |
CVE-2020-12692 | Medium | 5.4 | 2020-05-07 | An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The EC2 API doesn't have a signature TTL check for AWS Signature V4. An attacker can s… |
CVE-2018-20170 | Medium | 5.3 | 2018-12-17 | OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because invalid usernames have much faster responses than valid ones for a POST /v3/auth… |