Read the docs
TI-2020-10092 Aliases CVE-2020-12692GHSA-rqw2-hhrf-7936

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0.

Priority LOW 26CWE-294Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass, Information disclosure
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 4 fixed, 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-294 and CWE-311.

Summary

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The EC2 API doesn't have a signature TTL check for AWS Signature V4. An attacker can sniff the Authorization header, and then use it to reissue an OpenStack token an unlimited number of times.

Why it matters now

EPSS 0.00705 53rd percentileScored 2026-11-07
Fix Partial keystone (PyPI): 16.0.0, 15.0.1Red Hat: 3 advisoriesRed Hat: 4 fixed, 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—keystone (PyPI)16.0.0.0rc1 to before 16.0.016.0.0Patch availableGHSA-rqw2-hhrf-7936
—keystone (PyPI)before 15.0.115.0.1Patch availableGHSA-rqw2-hhrf-7936
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • keystone (PyPI) Vendor— Affected 16.0.0.0rc1 to before 16.0.0 Fixed in 16.0.0 Patch available GHSA-rqw2-hhrf-7936
  • keystone (PyPI) Vendor— Affected before 15.0.1 Fixed in 15.0.1 Patch available GHSA-rqw2-hhrf-7936

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:*before 15.0.1VulnerableOpenStack
cpe:2.3:a:openstack:keystone:16.0.0:*:*:*:*:*:*:*16.0.0VulnerableOpenStack
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*18.04VulnerableCanonical
  • cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:* Versions before 15.0.1 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:keystone:16.0.0:*:*:*:*:*:*:* Versions 16.0.0 Vulnerable ·OpenStack
  • cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical

Remediation

  • Fix · GHSA-rqw2-hhrf-7936 keystone (PyPI) Fixed in 16.0.0 Advisory →
  • Fix · GHSA-rqw2-hhrf-7936 keystone (PyPI) Fixed in 15.0.1 Advisory →

Red Hat 3 advisories

  • RHSA-2020:3105 Released 2020-07-22 · Red Hat rating Important
    openstack-keystone security update
    • Red Hat OpenStack Platform 16.0 openstack-keystone-1:16.0.1-0.20200511063421.40cbb7b.el8ost, python3-keystone-1:16.0.1-0.20200511063421.40cbb7b.el8ost
  • RHSA-2020:3102 Released 2020-07-22 · Red Hat rating Important
    openstack-keystone security update
    • Red Hat OpenStack Platform 15.0 openstack-keystone-1:15.0.1-0.20200512110437.95b2bbe.el8ost, python3-keystone-1:15.0.1-0.20200512110437.95b2bbe.el8ost
  • RHSA-2020:2732 Released 2020-06-24 · Red Hat rating Important
    openstack-keystone security update
    • Red Hat OpenStack Platform 13.0 openstack-keystone-1:13.0.4-3.el7ost, python-keystone-1:13.0.4-3.el7ost
    • Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Server openstack-keystone-1:13.0.4-3.el7ost, python-keystone-1:13.0.4-3.el7ost

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux OpenStack Platform 7 (Kilo)AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Will not fix
Red Hat Quay 3AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 13.0Fixed RHSA-2020:2732
Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS ServerFixed RHSA-2020:2732
Red Hat OpenStack Platform 15.0Fixed RHSA-2020:3102
Red Hat OpenStack Platform 16.0Fixed RHSA-2020:3105
Not affected: 1 product
  • Red Hat JBoss Fuse 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-12692
  2. 2026-10-03 Alias added: GHSA-rqw2-hhrf-7936

References

Advisory 6

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences