Read the docs
TI-2019-14184 Aliases CVE-2019-19687GHSA-2j23-fwqm-mgwr

OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials…

Priority MEDIUM 42CWE-522Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-522.

Summary

OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.)

Why it matters now

EPSS 0.0178 78th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed keystone (PyPI): 15.0.1, 16.0.1Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—keystone (PyPI)15.0.0 to before 15.0.115.0.1Patch availableGHSA-2j23-fwqm-mgwr
—keystone (PyPI)16.0.0 to before 16.0.116.0.1Patch availableGHSA-2j23-fwqm-mgwr
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • keystone (PyPI) Vendor— Affected 15.0.0 to before 15.0.1 Fixed in 15.0.1 Patch available GHSA-2j23-fwqm-mgwr
  • keystone (PyPI) Vendor— Affected 16.0.0 to before 16.0.1 Fixed in 16.0.1 Patch available GHSA-2j23-fwqm-mgwr

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:openstack:keystone:15.0.0:*:*:*:*:*:*:*15.0.0VulnerableOpenStack
cpe:2.3:a:openstack:keystone:16.0.0:*:*:*:*:*:*:*16.0.0VulnerableOpenStack
  • cpe:2.3:a:openstack:keystone:15.0.0:*:*:*:*:*:*:* Versions 15.0.0 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:keystone:16.0.0:*:*:*:*:*:*:* Versions 16.0.0 Vulnerable ·OpenStack

Remediation

  • Fix · GHSA-2j23-fwqm-mgwr keystone (PyPI) Fixed in 15.0.1 Advisory →
  • Fix · GHSA-2j23-fwqm-mgwr keystone (PyPI) Fixed in 16.0.1 Advisory →

Red Hat 1 advisory

  • RHSA-2019:4358 Released 2019-12-19 · Red Hat rating Important
    openstack-keystone security update
    • Red Hat OpenStack Platform 15.0 openstack-keystone-1:15.0.1-0.20190720060412.5f27c4b.1.el8ost, python3-keystone-1:15.0.1-0.20190720060412.5f27c4b.1.el8ost

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenStack Platform 15.0Fixed RHSA-2019:4358
Red Hat OpenStack Platform 16.0Fixed—
Not affected: 3 products
  • Red Hat JBoss Fuse 6
  • Red Hat OpenStack 16 Cinderlib
  • Red Hat OpenStack Platform 16.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-19687
  2. 2026-10-03 Alias added: GHSA-2j23-fwqm-mgwr

References

Exploit 1

Patch 3

Advisory 5

Other 13

  • TI-2026-25942 Incorrect authorization in OpenStack Keystone CVSS 3.1MEDIUM 5.3
  • TI-2020-10091 An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. CVSS 3.1HIGH 8.8
  • TI-2020-10090 An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. CVSS 3.1HIGH 8.8
  • TI-2020-10089 An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. CVSS 3.1HIGH 8.8
  • TI-2014-02273 The V3 API in OpenStack Identity (Keystone) 2013.1 before 2013.2.4 and icehouse before… CVSS 2.0HIGH 7.8
  • TI-2012-03798 The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2… CVSS 2.0HIGH 7.5
See all 43 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences