An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0.
Priority MEDIUM 42CWE-613Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 2 fixed, 3 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-613.
Summary
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access.
Why it matters now
EPSS 0.01896 79th percentileScored 2026-11-07
Fix Partial keystone (PyPI): 15.0.1, 16.0.0Red Hat: 2 advisoriesRed Hat: 2 fixed, 3 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | keystone (PyPI) | before 15.0.1 | 15.0.1 | Patch available | GHSA-6m8p-x4qw-gh5j |
| — | keystone (PyPI) | 16.0.0.0rc1 to before 16.0.0 | 16.0.0 | Patch available | GHSA-6m8p-x4qw-gh5j |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- keystone (PyPI) Vendor— Affected before 15.0.1 Fixed in 15.0.1 Patch available GHSA-6m8p-x4qw-gh5j
- keystone (PyPI) Vendor— Affected 16.0.0.0rc1 to before 16.0.0 Fixed in 16.0.0 Patch available GHSA-6m8p-x4qw-gh5j
Remediation
- Fix · GHSA-6m8p-x4qw-gh5j keystone (PyPI) Fixed in 15.0.1 Advisory →
- Fix · GHSA-6m8p-x4qw-gh5j keystone (PyPI) Fixed in 16.0.0 Advisory →
Red Hat 2 advisories
- RHSA-2020:3105 Released 2020-07-22 · Red Hat rating Importantopenstack-keystone security update
- Red Hat OpenStack Platform 16.0 openstack-keystone-1:16.0.1-0.20200511063421.40cbb7b.el8ost, python3-keystone-1:16.0.1-0.20200511063421.40cbb7b.el8ost
- RHSA-2020:3102 Released 2020-07-22 · Red Hat rating Importantopenstack-keystone security update
- Red Hat OpenStack Platform 15.0 openstack-keystone-1:15.0.1-0.20200512110437.95b2bbe.el8ost, python3-keystone-1:15.0.1-0.20200512110437.95b2bbe.el8ost
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux OpenStack Platform 7 (Kilo) | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 10 (Newton) | Affected | No fix yet |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix yet |
| Red Hat OpenStack Platform 15.0 | Fixed | RHSA-2020:3102 |
| Red Hat OpenStack Platform 16.0 | Fixed | RHSA-2020:3105 |
Not affected: 2 products
- Red Hat JBoss Fuse 6
- Red Hat Quay 3
Timeline
- 2026-10-02 Threatist record created from CVE-2020-12690
- 2026-10-03 Alias added: GHSA-6m8p-x4qw-gh5j
References
Advisory 6
- https://security.openstack.org/ossa/OSSA-2020-005.html
- https://www.openwall.com/lists/oss-security/2020/05/06/6
- [oss-security] 20200507 Re: [OSSA-2020-005] Keystone: OAuth1 request token authorize silently ignores roles parameter (CVE PENDING)
- USN-4480-1
- https://nvd.nist.gov/vuln/detail/CVE-2020-12690
- https://github.com/advisories/GHSA-6m8p-x4qw-gh5j
Other 6
- [druid-commits] 20200520 [GitHub] [druid] ccaominh opened a new pull request #9903: Suppress CVEs for openstack-keystone
- [druid-commits] 20210712 [druid] branch master updated: Suppress CVE-2021-27568 from json-smart 2.3 dependency (#11438)
- https://github.com/openstack/keystone
- https://github.com/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2020-54.yaml
- https://lists.apache.org/thread.html/re4ffc55cd2f1b55a26e07c83b3c22c3fe4bae6054d000a57fb48d8c2@%3Ccommits.druid.apache.org%3E
- https://usn.ubuntu.com/4480-1
More OpenStack Keystone vulnerabilities
- TI-2026-25942 Incorrect authorization in OpenStack Keystone CVSS 3.1MEDIUM 5.3
- TI-2020-10091 An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. CVSS 3.1HIGH 8.8
- TI-2019-14184 OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials… CVSS 3.1HIGH 8.8
- TI-2020-10089 An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. CVSS 3.1HIGH 8.8
- TI-2014-02273 The V3 API in OpenStack Identity (Keystone) 2013.1 before 2013.2.4 and icehouse before… CVSS 2.0HIGH 7.8
- TI-2012-03798 The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2… CVSS 2.0HIGH 7.5
Sources
- CVE-2020-12690 · CVE Program
- CVE-2020-12690 · NVD
- FIRST EPSS
- GHSA-6m8p-x4qw-gh5j · GitHub Advisory Database · CC BY 4.0
- CVE-2020-12690 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences