Keystone (Openstack) - vulnerabilities (CVEs)

50 CVEs, 0 in the last 30 days, 167 known versions, newest CVE from 2026-09-11. Vendor: Openstack.

CVEs of Keystone

CVE-2026-90460 - CVSS 7.6 (high), 2026-09-11: An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods (EC2 credentials, application credentials,…
CVE-2026-80183 - CVSS 7.1 (high), 2026-08-26: In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignment under any domain…
CVE-2026-80184 - CVSS 7.6 (high), 2026-08-25: In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms (OAuth1 access tokens, application credentials, trusts) could be…
CVE-2026-80182 - CVSS 7.6 (high), 2026-08-25: In OpenStack Keystone before 29.0.3, tokens obtained via OAuth1 access token, application credential, or trust-scoped authentication could create new…
CVE-2026-44394 - CVSS 8.1 (high), 2026-05-28: An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone federated token rescoping mechanism does not propagate the original token's expiry…
CVE-2026-43000 - CVSS 8.8 (high), 2026-05-28: An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation vulnerability, an attacker with the…
CVE-2026-42999 - CVSS 8.8 (high), 2026-05-28: An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone RBAC policy enforcer in enforce_call unconditionally merges the raw JSON request…
CVE-2026-42998 - CVSS 8.8 (high), 2026-05-28: An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone application credential authentication plugin does not verify that the user supplied…
CVE-2026-43001 - CVSS 8 (high), 2026-05-01: An issue was discovered in OpenStack Keystone before 29.0.2. POST /v3/credentials did not validate that the caller-supplied project_id for an EC2-type…
CVE-2026-40683 - CVSS 7.7 (high), 2026-04-14: In OpenStack Keystone before 28.0.1, the LDAP identity backend does not convert the user enabled attribute to a boolean when the user_enabled_invert…
CVE-2026-33551 - CVSS 5.3 (medium), 2026-04-10: An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0. Restricted application credentials can create EC2…
CVE-2025-65073 - CVSS 7.5 (high), 2025-11-17: OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Signature to provide Keystone…
CVE-2022-2447 - CVSS 6.6 (medium), 2022-09-01: A flaw was found in Keystone. There is a time lag (up to one hour in a default configuration) between when security policy says a token should be revoked from…
CVE-2021-3563 - CVSS 7.4 (high), 2022-08-26: A flaw was found in openstack-keystone. Only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity…
CVE-2021-38155 - CVSS 7.5 (high), 2021-08-06: OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclosure during…
CVE-2020-12689 - CVSS 8.8 (high), 2020-05-07: An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any user authenticated within a limited scope (trust/oauth/application credential)…
CVE-2020-12692 - CVSS 5.4 (medium), 2020-05-07: An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The EC2 API doesn't have a signature TTL check for AWS Signature V4. An attacker can…
CVE-2020-12691 - CVSS 8.8 (high), 2020-05-07: An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any authenticated user can create an EC2 credential for themselves for a project that…
CVE-2020-12690 - CVSS 8.8 (high), 2020-05-07: An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when…
CVE-2019-19687 - CVSS 8.8 (high), 2019-12-09: OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any…
CVE-2012-1572 - CVSS 7.5 (high), 2019-11-12: OpenStack Keystone: extremely long passwords can crash Keystone by exhausting stack space
CVE-2013-2255 - CVSS 5.9 (medium), 2019-11-01: HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side SSL certificates.
CVE-2018-20170 - CVSS 5.3 (medium), 2018-12-17: OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because invalid usernames have much faster responses than valid ones for a POST…
CVE-2018-14432 - CVSS 5.3 (medium), 2018-07-31: In the Federation component of OpenStack Keystone before 11.0.4, 12.0.0, and 13.0.0, an authenticated "GET /v3/OS-FEDERATION/projects" request may bypass…
CVE-2015-7546 - CVSS 7.5 (high), 2016-02-03: The identity service in OpenStack Identity (Keystone) before 2015.1.3 (Kilo) and 8.0.x before 8.0.2 (Liberty) and keystonemiddleware (formerly…
CVE-2015-3646 - CVSS 4 (medium), 2015-05-12: OpenStack Identity (Keystone) before 2014.1.5 and 2014.2.x before 2014.2.4 logs the backend_argument configuration option content, which allows remote…
CVE-2014-0204 - CVSS 6.5 (medium), 2014-11-03: OpenStack Identity (Keystone) before 2014.1.1 does not properly handle when a role is assigned to a group that has the same ID as a user, which allows remote…
CVE-2014-3520 - CVSS 6.5 (medium), 2014-10-26: OpenStack Identity (Keystone) before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2 allows remote authenticated trustees to gain access to an…
CVE-2014-3621 - CVSS 4 (medium), 2014-10-02: The catalog url replacement in OpenStack Identity (Keystone) before 2013.2.3 and 2014.1 before 2014.1.2.1 allows remote authenticated users to read sensitive…
CVE-2014-5251 - CVSS 4.9 (medium), 2014-08-25: The MySQL token driver in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 stores timestamps with the incorrect precision,…
CVE-2014-5253 - CVSS 4.9 (medium), 2014-08-25: OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 does not properly revoke tokens when a domain is invalidated, which allows…
CVE-2014-5252 - CVSS 4.9 (medium), 2014-08-25: The V3 API in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 updates the issued_at value for UUID v2 tokens, which allows…
CVE-2014-3476 - CVSS 6 (medium), 2014-06-17: OpenStack Identity (Keystone) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 does not properly handle chained delegation, which allows remote…
CVE-2013-2014 - CVSS 5 (medium), 2014-06-02: OpenStack Identity (Keystone) before 2013.1 allows remote attackers to cause a denial of service (memory consumption and crash) via multiple long requests.
CVE-2014-2828 - CVSS 7.8 (high), 2014-04-15: The V3 API in OpenStack Identity (Keystone) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 allows remote attackers to cause a denial of service (CPU…
CVE-2014-2237 - CVSS 5 (medium), 2014-04-01: The memcache token backend in OpenStack Identity (Keystone) 2013.1 through 2.013.1.4, 2013.2 through 2013.2.2, and icehouse before icehouse-3, when issuing a…
CVE-2013-6391 - CVSS 5.8 (medium), 2013-12-14: The ec2tokens API in OpenStack Identity (Keystone) before Havana 2013.2.1 and Icehouse before icehouse-2 does not return a trust-scoped token when one is…
CVE-2013-4222 - CVSS 6.5 (medium), 2013-09-30: OpenStack Identity (Keystone) Folsom, Grizzly 2013.1.3 and earlier, and Havana before havana-3 does not properly revoke user tokens when a tenant is disabled,…
CVE-2013-4294 - CVSS 5 (medium), 2013-09-23: The (1) mamcache and (2) KVS token backends in OpenStack Identity (Keystone) Folsom 2012.2.x and Grizzly before 2013.1.4 do not properly compare the PKI token…
CVE-2013-2157 - CVSS 4.3 (medium), 2013-08-20: OpenStack Keystone Folsom, Grizzly before 2013.1.3, and Havana, when using LDAP with Anonymous binding, allows remote attackers to bypass authentication via…
CVE-2013-2006 - CVSS 2.1 (low), 2013-05-21: OpenStack Identity (Keystone) Grizzly 2013.1.1, when DEBUG mode logging is enabled, logs the (1) admin_token and (2) LDAP password in plaintext, which allows…
CVE-2013-2059 - CVSS 6 (medium), 2013-05-21: OpenStack Identity (Keystone) Folsom 2012.2.4 and earlier, Grizzly before 2013.1.1, and Havana does not immediately revoke the authentication token when…
CVE-2013-0282 - CVSS 5 (medium), 2013-04-12: OpenStack Keystone Grizzly before 2013.1, Folsom 2012.1.3 and earlier, and Essex does not properly check if the (1) user, (2) tenant, or (3) domain is enabled…
CVE-2013-0270 - CVSS 6.5 (medium), 2013-04-12: A flaw was found in OpenStack Keystone. A remote attacker could exploit this vulnerability by sending a large HTTP request, specifically by providing a long…
CVE-2013-0247 - CVSS 5 (medium), 2013-02-24: OpenStack Keystone Essex 2012.1.3 and earlier, Folsom 2012.2.3 and earlier, and Grizzly grizzly-2 and earlier allows remote attackers to cause a denial of…
CVE-2012-5483 - CVSS 2.1 (low), 2012-12-26: tools/sample_data.sh in OpenStack Keystone 2012.1.3, when access to Amazon Elastic Compute Cloud (Amazon EC2) is configured, uses world-readable permissions…
CVE-2012-4456 - CVSS 7.5 (high), 2012-10-09: The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token,…
CVE-2012-4457 - CVSS 4 (medium), 2012-10-09: OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-3 does not properly handle authorization tokens for disabled tenants, which allows remote…
CVE-2012-4413 - CVSS 4 (medium), 2012-09-18: OpenStack Keystone 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to retain the…
CVE-2012-3426 - CVSS 4.9 (medium), 2012-07-31: OpenStack Keystone before 2012.1.1, as used in OpenStack Folsom before Folsom-1 and OpenStack Essex, does not properly implement token expiration, which…