Read the docs
TI-2020-10089 Aliases CVE-2020-12689GHSA-chgw-36xv-47cw

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0.

Priority MEDIUM 41CWE-269Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 5 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-269.

Summary

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any user authenticated within a limited scope (trust/oauth/application credential) can create an EC2 credential with an escalated permission, such as obtaining admin while the user is on a limited viewer role. This potentially allows a malicious user to act as the admin on a project another user has the admin role on, which can effectively grant that user global admin privileges.

Why it matters now

EPSS 0.01562 75th percentileScored 2026-11-07
Fix Partial keystone (PyPI): 15.0.1, 16.0.1Red Hat: 4 advisoriesRed Hat: 5 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—keystone (PyPI)before 15.0.115.0.1Patch availableGHSA-chgw-36xv-47cw
—keystone (PyPI)16.0.0 to before 16.0.116.0.1Patch availableGHSA-chgw-36xv-47cw
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • keystone (PyPI) Vendor— Affected before 15.0.1 Fixed in 15.0.1 Patch available GHSA-chgw-36xv-47cw
  • keystone (PyPI) Vendor— Affected 16.0.0 to before 16.0.1 Fixed in 16.0.1 Patch available GHSA-chgw-36xv-47cw

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:*before 15.0.1VulnerableOpenStack
cpe:2.3:a:openstack:keystone:16.0.0:*:*:*:*:*:*:*16.0.0VulnerableOpenStack
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*18.04VulnerableCanonical
  • cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:* Versions before 15.0.1 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:keystone:16.0.0:*:*:*:*:*:*:* Versions 16.0.0 Vulnerable ·OpenStack
  • cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical

Remediation

  • Fix · GHSA-chgw-36xv-47cw keystone (PyPI) Fixed in 15.0.1 Advisory →
  • Fix · GHSA-chgw-36xv-47cw keystone (PyPI) Fixed in 16.0.1 Advisory →

Red Hat 4 advisories

  • RHSA-2020:3105 Released 2020-07-22 · Red Hat rating Important
    openstack-keystone security update
    • Red Hat OpenStack Platform 16.0 openstack-keystone-1:16.0.1-0.20200511063421.40cbb7b.el8ost, python3-keystone-1:16.0.1-0.20200511063421.40cbb7b.el8ost
  • RHSA-2020:3102 Released 2020-07-22 · Red Hat rating Important
    openstack-keystone security update
    • Red Hat OpenStack Platform 15.0 openstack-keystone-1:15.0.1-0.20200512110437.95b2bbe.el8ost, python3-keystone-1:15.0.1-0.20200512110437.95b2bbe.el8ost
  • RHSA-2020:3096 Released 2020-07-22 · Red Hat rating Important
    openstack-keystone security update
    • Red Hat OpenStack Platform 10.0 openstack-keystone-1:10.0.3-8.el7ost, python-keystone-1:10.0.3-8.el7ost, python-keystone-tests-1:10.0.3-8.el7ost
Show 1 more Red Hat advisories
  • RHSA-2020:2732 Released 2020-06-24 · Red Hat rating Important
    openstack-keystone security update
    • Red Hat OpenStack Platform 13.0 openstack-keystone-1:13.0.4-3.el7ost, python-keystone-1:13.0.4-3.el7ost
    • Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Server openstack-keystone-1:13.0.4-3.el7ost, python-keystone-1:13.0.4-3.el7ost

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux OpenStack Platform 7 (Kilo)AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 10.0Fixed RHSA-2020:3096
Red Hat OpenStack Platform 13.0Fixed RHSA-2020:2732
Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS ServerFixed RHSA-2020:2732
Red Hat OpenStack Platform 15.0Fixed RHSA-2020:3102
Red Hat OpenStack Platform 16.0Fixed RHSA-2020:3105
Not affected: 2 products
  • Red Hat JBoss Fuse 6
  • Red Hat Quay 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-12689
  2. 2026-10-03 Alias added: GHSA-chgw-36xv-47cw

References

Patch 1

Advisory 5

Other 6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences