keystone vulnerabilities
CVEs whose affected-version data names the keystone package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
24 CVEsRSS
CVE-2026-90460High· 7.6PoCAn issue was discovered in OpenStack Keystone before 29.0.3
An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods (EC2 credentials, application credentials, OAuth1 access tokens, and trusts) are not blocked from creating, modifying, or d…
CVE-2026-80183High· 7.1In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignment under any domain by passing a domain ID as scope.project.id with include_subtree to the GET /v3/…
In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignment under any domain by passing a domain ID as scope.project.id with include_subtree to the GET /v3/…
CVE-2026-44394Medium· 6.0OpenStack Keystone's federated token rescoping mechanism doesn't propagate the original token's expiry to the newly issued token
OpenStack Keystone's federated token rescoping mechanism doesn't propagate the original token's expiry to the newly issued token
CVE-2026-43000Medium· 6.0OpenStack Keystone has an Incorrect Authorization issue
OpenStack Keystone has an Incorrect Authorization issue
CVE-2026-42998Medium· 6.0OpenStack Keystone doesn't verify that the user supplied in the authentication request matches the owner of the application credential
OpenStack Keystone doesn't verify that the user supplied in the authentication request matches the owner of the application credential
CVE-2026-42999Medium· 6.0OpenStack Keystone has an Authorization Bypass
OpenStack Keystone has an Authorization Bypass
CVE-2025-65073High· 7.5OpenStack Keystone allows /v3/ec2tokens or /v3/s3tokens request with valid AWS Signature to provide Keystone authorization.
OpenStack Keystone allows /v3/ec2tokens or /v3/s3tokens request with valid AWS Signature to provide Keystone authorization.
CVE-2021-38155High· 7.5OpenStack Keystone allows information disclosure during account locking
OpenStack Keystone allows information disclosure during account locking
CVE-2012-3542High· 7.5OpenStack Keystone Allows Remote User Account Creation
OpenStack Keystone Allows Remote User Account Creation
CVE-2012-4413MediumOpenStack Keystone does not invalidate existing tokens when granting or revoking roles
OpenStack Keystone does not invalidate existing tokens when granting or revoking roles
CVE-2013-4477LowOpenStack Identity Keystone Privilege Escalation vulnerability
OpenStack Identity Keystone Privilege Escalation vulnerability
CVE-2012-4457MediumOpenStack Keystone Token authorization for a user in a disabled tenant is allowed
OpenStack Keystone Token authorization for a user in a disabled tenant is allowed
CVE-2012-4456HighOpenStack Keystone Improper Authentication vulnerability
OpenStack Keystone Improper Authentication vulnerability
CVE-2015-7546High· 7.5OpenStack Identity Keystone and keystonemiddleware Insufficiently Protected Credentials
OpenStack Identity Keystone and keystonemiddleware Insufficiently Protected Credentials
CVE-2015-3646MediumOpenStack Keystone Logs Passwords
OpenStack Keystone Logs Passwords
CVE-2014-0204MediumOpenStack Identity Keystone Improper Privilege Management
OpenStack Identity Keystone Improper Privilege Management
CVE-2014-3621MediumOpenStack Identity Keystone Exposure of Sensitive Information
OpenStack Identity Keystone Exposure of Sensitive Information
CVE-2013-2014MediumOpenStack Identity (Keystone) Denial of Service
OpenStack Identity (Keystone) Denial of Service
CVE-2014-3476MediumOpenStack Identity Keystone is vulnerable to Block delegation escalation of privilege
OpenStack Identity Keystone is vulnerable to Block delegation escalation of privilege
CVE-2013-2255Medium· 5.9OpenStack Keystone and other components vulnerable to Improper Certificate Validation
OpenStack Keystone and other components vulnerable to Improper Certificate Validation
CVE-2013-0282MediumOpenStack Keystone allows context-dependent attackers to bypass access restrictions
OpenStack Keystone allows context-dependent attackers to bypass access restrictions
CVE-2013-0270Medium· 6.5OpenStack Keystone Denial of Service vulnerability via a large HTTP request
OpenStack Keystone Denial of Service vulnerability via a large HTTP request
CVE-2017-2673High· 7.2An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service (keystone). An authenticated fe…
An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service (keystone). An authenticated federated user could request permissions to a project and unintentionally be granted all related roles…
CVE-2013-1865NoneOpenStack Keystone Folsom (2012.2) does not properly perform revocation checks for Keystone PKI tokens when done through a server, which …
OpenStack Keystone Folsom (2012.2) does not properly perform revocation checks for Keystone PKI tokens when done through a server, which allows remote attackers to bypass intended access restrictions via a revoked PKI token.