keystone_json_assignment backend granted access to any project for users in user-project-map.json
Priority MEDIUM 40CWE-732Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
The keystone-json-assignment package in SUSE Openstack Cloud 8 before commit d7888c75505465490250c00cc0ef4bb1af662f9f every user listed in the /etc/keystone/user-project-map.json was assigned full "member" role access to every project. This allowed these users to access, modify, create and delete arbitrary resources, contrary to expectations.
Why it matters now
EPSS 0.00935 61st percentileScored 2026-11-07
Fix Fixed SUSE Openstack Cloud 8 (SUSE): d7888c75505465490250c00cc0ef4bb1af662f9f
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SUSE | SUSE Openstack Cloud 8 | keystone-json-assignment to before d7888c75505465490250c00cc0ef4bb1af662f9f | d7888c75505465490250c00cc0ef4bb1af662f9f | Patch available | CNA |
- SUSE Openstack Cloud 8 VendorSUSE Affected keystone-json-assignment to before d7888c75505465490250c00cc0ef4bb1af662f9f Fixed in d7888c75505465490250c00cc0ef4bb1af662f9f Patch available CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:suse:openstack_cloud:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | SUSE |
| cpe:2.3:a:suse:keystone-json-assignment:*:*:*:*:*:*:*:* | before 2019-02-18 | Vulnerable | SUSE |
| cpe:2.3:a:hp:helion_openstack:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Hewlett Packard Enterprise |
- cpe:2.3:a:suse:openstack_cloud:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·SUSE
- cpe:2.3:a:suse:keystone-json-assignment:*:*:*:*:*:*:*:* Versions before 2019-02-18 Vulnerable ·SUSE
- cpe:2.3:a:hp:helion_openstack:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Hewlett Packard Enterprise
Remediation
- Fix · CNA SUSE Openstack Cloud 8 (SUSE) Fixed in d7888c75505465490250c00cc0ef4bb1af662f9f
Timeline
- 2026-10-02 Threatist record created from CVE-2019-3683
- 2026-10-03 Alias added: GHSA-pfwx-2ff5-2g47
References
Sources
- CVE-2019-3683 · CVE Program
- CVE-2019-3683 · NVD
- FIRST EPSS
- GHSA-pfwx-2ff5-2g47 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences