CVE-2021-38155High· 7.5▾ TwilightOpenStack Keystone allows information disclosure during account locking
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.5 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
2.5%
2.5% → 2.5%
OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclosure during account locking (related to PCI DSS features). By guessing the name of an account and failing to authenticate multiple times, any unauthenticated actor could both confirm the account exists and obtain that account's corresponding UUID, which might be leveraged for other unrelated attacks. All deployments enabling security_compliance.lockout_failure_attempts are affected.
keystone >= 10.0, < 16.0.2keystone >= 17.0, < 17.0.1keystone >= 18.0, < 18.0.1keystone >= 19.0, < 19.0.1Upgrade to a patched release:
keystone 16.0.2keystone 17.0.1keystone 18.0.1keystone 19.0.1Connected by shared product, vendor, weakness, or advisory.
CVE-2012-3542High· 7.5OpenStack Keystone Allows Remote User Account Creation
CVE-2012-4457MediumOpenStack Keystone Token authorization for a user in a disabled tenant is allowed
CVE-2026-44394Medium· 6.0OpenStack Keystone's federated token rescoping mechanism doesn't propagate the original token's expiry to the newly issued token
CVE-2026-43000Medium· 6.0OpenStack Keystone has an Incorrect Authorization issue
CVE-2012-4456HighOpenStack Keystone Improper Authentication vulnerability
CVE-2015-3646MediumOpenStack Keystone Logs Passwords