TI-2018-14292 Aliases CVE-2018-20170 GHSA-jpv2-hwjh-97c7

OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because invalid…

LOW 32CWE-200Published 2018-12-17 · Updated 2024-11-14

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-200.

Summary

OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because invalid usernames have much faster responses than valid ones for a POST /v3/auth/tokens request. NOTE: the vendor's position is that this is a hardening opportunity, and not necessarily an issue that should have an OpenStack Security Advisory

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0112 66th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:openstack:keystone::::::::	up to 14.0.1	Vulnerable	OpenStack

cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:* Versions up to 14.0.1 Vulnerable ·OpenStack

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2018-20170
2026-10-03 Alias added: GHSA-jpv2-hwjh-97c7

References

Exploit 1

https://bugs.launchpad.net/keystone/+bug/1795800

TI-2026-25942 Incorrect authorization in OpenStack Keystone CVSS 3.1MEDIUM 5.3
TI-2020-10091 An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. CVSS 3.1HIGH 8.8
TI-2020-10090 An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. CVSS 3.1HIGH 8.8
TI-2019-14184 OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials… CVSS 3.1HIGH 8.8
TI-2020-10089 An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. CVSS 3.1HIGH 8.8
TI-2014-02273 The V3 API in OpenStack Identity (Keystone) 2013.1 before 2013.2.4 and icehouse before… CVSS 2.0HIGH 7.8

See all 43 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences