Read the docs

OpenStack

Records333All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical23CVSS 9.0–10.0
CVSS high77CVSS 7.0–8.9

Exploited now

OpenStack records in CISA KEV

No OpenStack vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Keystone 44 records MEDIUM Nova 39 records HIGH Folsom 25 records LOW Neutron 25 records MEDIUM Horizon 24 records MEDIUM Essex 15 records LOW Image Registry And Delivery Service (glance) 15 records LOW Swift 15 records MEDIUM

Records

44 records in Keystone · all components

TI-2026-25942 CVE-2026-33551 · GHSA-4phw-6824-6cfp

Incorrect authorization in OpenStack Keystone

Priority MEDIUM 57

An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0.

CVSS 3.1MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00228 Published 2026-04-10 Fixed in 26.1.1 CWE-863
TI-2014-02273 CVE-2014-2828 · GHSA-6mv3-p2gr-wgqf

The V3 API in OpenStack Identity (Keystone) 2013.1 before 2013.2.4 and icehouse before…

Priority MEDIUM 40

The V3 API in OpenStack Identity (Keystone) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 allows remote attackers to cause a denial of service (CPU consumption) via a large number of the same authentication met…

CVSS 2.0HIGH 7.8 Network No auth Interaction — EPSS 0.03216 Published 2014-04-15 Partial fix · 8.0.0a0 CWE-287
TI-2012-03798 CVE-2012-4456 · GHSA-mf98-r2gf-2x3w

The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2…

Priority MEDIUM 40

The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.03998 Published 2012-10-09 Fixed in 2012.1.2 CWE-287
TI-2026-31180 CVE-2026-43000 · GHSA-q623-f4j4-p4xj

Incorrect authorization in OpenStack Keystone

Priority LOW 38

An issue was discovered in OpenStack Keystone before 29.0.2.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00328 Published 2026-05-28 Partial fix · 27.0.2, 28.0.2 +1 CWE-863
TI-2026-31179 CVE-2026-42999 · GHSA-2r23-2g6v-2m5f

Incorrect authorization in OpenStack Keystone

Priority LOW 38

An issue was discovered in OpenStack Keystone before 29.0.2.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00329 Published 2026-05-28 Partial fix · 27.0.2, 28.0.2 +1 CWE-863
TI-2026-31178 CVE-2026-42998 · GHSA-8f8m-wrvr-wcvf

Incorrect authorization in OpenStack Keystone

Priority LOW 38

An issue was discovered in OpenStack Keystone before 29.0.2.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00303 Published 2026-05-28 Partial fix · 27.0.2, 28.0.2 +1 CWE-863
TI-2015-06273 CVE-2015-7546 · GHSA-8c4w-v65p-jvcv

The identity service in OpenStack Identity (Keystone) before 2015.1.3 (Kilo) and 8.0.x…

Priority LOW 37

The identity service in OpenStack Identity (Keystone) before 2015.1.3 (Kilo) and 8.0.x before 8.0.2 (Liberty) and keystonemiddleware (formerly python-keystoneclient) before 1.5.4 (Kilo) and Liberty before 2.3.3 does not…

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.01997 Published 2016-02-03 Partial fix · 9.0.0.0b2, 4.1.0 +3 CWE-522
TI-2021-02513 CVE-2021-3563 · GHSA-cc99-whm5-mmq3

Incorrect authorization in keystone

Priority LOW 36

A flaw was found in openstack-keystone.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.01863 Published 2022-08-26 No fix listed CWE-863
TI-2026-32344 CVE-2026-44394 · GHSA-whqr-fgm5-x77q

Incorrect authorization in OpenStack Keystone

Priority LOW 35

An issue was discovered in OpenStack Keystone before 29.0.2.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00249 Published 2026-05-28 Partial fix · 27.0.2, 28.0.2 +1 CWE-863
TI-2026-31181 CVE-2026-43001 · GHSA-hhq2-3832-xxcv

Incorrect authorization in OpenStack Keystone

Priority LOW 35

An issue was discovered in OpenStack Keystone before 29.0.2.

CVSS 3.1HIGH 8.0 Network High privileges No interaction EPSS 0.00466 Published 2026-05-01 Fixed in 27.0.2, 28.0.2 +1 CWE-863
TI-2014-02846 CVE-2014-3520 · GHSA-mv96-4gm9-mjhw

OpenStack Identity (Keystone) before 2013.2.4, 2014.x before 2014.1.2, and Juno before…

Priority LOW 33

OpenStack Identity (Keystone) before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2 allows remote authenticated trustees to gain access to an unauthorized project for which the trustor has certain roles via the…

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.01907 Published 2014-10-26 Partial fix CWE-863
TI-2013-03694 CVE-2013-4222 · GHSA-g99j-vfcp-3vmf

OpenStack Identity (Keystone) Folsom, Grizzly 2013.1.3 and earlier, and Havana before…

Priority LOW 33

OpenStack Identity (Keystone) Folsom, Grizzly 2013.1.3 and earlier, and Havana before havana-3 does not properly revoke user tokens when a tenant is disabled, which allows remote authenticated users to retain access via…

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.01892 Published 2013-09-30 Partial fix CWE-522
TI-2014-00197 CVE-2014-0204 · GHSA-c4p9-87h3-7vr4

OpenStack Identity (Keystone) before 2014.1.1 does not properly handle when a role is…

Priority LOW 32

OpenStack Identity (Keystone) before 2014.1.1 does not properly handle when a role is assigned to a group that has the same ID as a user, which allows remote authenticated users to gain privileges that are assigned to a…

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.01397 Published 2014-11-03 Fixed in 8.0.0a0 CWE-269
TI-2013-01830 CVE-2013-2059 · GHSA-hj89-qmx9-8qmh

OpenStack Identity (Keystone) Folsom 2012.2.4 and earlier, Grizzly before 2013.1.1, and…

Priority LOW 32

OpenStack Identity (Keystone) Folsom 2012.2.4 and earlier, Grizzly before 2013.1.1, and Havana does not immediately revoke the authentication token when deleting a user through the Keystone v2 API, which allows remote au…

CVSS 2.0MEDIUM 6.0 Network Low privileges Interaction — EPSS 0.02468 Published 2013-05-21 Fixed in 8.0.0a0 CWE-287
TI-2014-02803 CVE-2014-3476 · GHSA-274v-r947-v34r

OpenStack Identity (Keystone) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before…

Priority LOW 31

OpenStack Identity (Keystone) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 does not properly handle chained delegation, which allows remote authenticated users to gain privileges by leveraging a (1) tr…

CVSS 2.0MEDIUM 6.0 Network Low privileges Interaction — EPSS 0.02327 Published 2014-06-17 Partial fix · 8.0.0a0 CWE-269
TI-2022-02260 CVE-2022-2447 · GHSA-r88f-774m-5rj4

A flaw was found in Keystone.

Priority LOW 30

A flaw was found in Keystone.

CVSS 3.1MEDIUM 6.6 Network High privileges No interaction EPSS 0.00719 Published 2022-09-01 No fix listed CWE-324
Load more
Open these records in search →