OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before…
Priority LOW 38CWE-307Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-307.
Summary
OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclosure during account locking (related to PCI DSS features). By guessing the name of an account and failing to authenticate multiple times, any unauthenticated actor could both confirm the account exists and obtain that account's corresponding UUID, which might be leveraged for other unrelated attacks. All deployments enabling security_compliance.lockout_failure_attempts are affected.
Why it matters now
EPSS 0.02478 84th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed keystone (PyPI): 16.0.2, 17.0.1, 18.0.1 +1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | keystone (PyPI) | 10.0 to before 16.0.2 | 16.0.2 | Patch available | GHSA-4225-97pr-rr52 |
| — | keystone (PyPI) | 17.0 to before 17.0.1 | 17.0.1 | Patch available | GHSA-4225-97pr-rr52 |
| — | keystone (PyPI) | 18.0 to before 18.0.1 | 18.0.1 | Patch available | GHSA-4225-97pr-rr52 |
| — | keystone (PyPI) | 19.0 to before 19.0.1 | 19.0.1 | Patch available | GHSA-4225-97pr-rr52 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- keystone (PyPI) Vendor— Affected 10.0 to before 16.0.2 Fixed in 16.0.2 Patch available GHSA-4225-97pr-rr52
- keystone (PyPI) Vendor— Affected 17.0 to before 17.0.1 Fixed in 17.0.1 Patch available GHSA-4225-97pr-rr52
- keystone (PyPI) Vendor— Affected 18.0 to before 18.0.1 Fixed in 18.0.1 Patch available GHSA-4225-97pr-rr52
- keystone (PyPI) Vendor— Affected 19.0 to before 19.0.1 Fixed in 19.0.1 Patch available GHSA-4225-97pr-rr52
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:* | 10.0.0 to before 16.0.2; 17.0.0 to before 17.0.1; 18.0.0 to before 18.0.1; 19.0.0 to before 19.0.1 | Vulnerable | OpenStack |
- cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:* Versions 10.0.0 to before 16.0.2; 17.0.0 to before 17.0.1; 18.0.0 to before 18.0.1; 19.0.0 to before 19.0.1 Vulnerable ·OpenStack
Remediation
- Fix · GHSA-4225-97pr-rr52 keystone (PyPI) Fixed in 16.0.2 Advisory →
- Fix · GHSA-4225-97pr-rr52 keystone (PyPI) Fixed in 17.0.1 Advisory →
- Fix · GHSA-4225-97pr-rr52 keystone (PyPI) Fixed in 18.0.1 Advisory →
- Fix · GHSA-4225-97pr-rr52 keystone (PyPI) Fixed in 19.0.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-38155
- 2026-10-03 Alias added: GHSA-4225-97pr-rr52
References
Exploit 1
Patch 2
Other 5
- [debian-lts-announce] 20240121 [SECURITY] [DLA 3714-1] keystone security update
- https://github.com/openstack/keystone/commit/1b573ae7d1c20e0ebfbde79bbe7538a09589c75d
- https://github.com/openstack/keystone/commit/8ab4eb27be4c13c9bab2b3ea700f00a190521bf8
- https://github.com/openstack/keystone/commit/ac2631ae33445877094cdae796fbcdce8833a626
- https://github.com/openstack/keystone
More OpenStack Keystone vulnerabilities
- TI-2026-25942 Incorrect authorization in OpenStack Keystone CVSS 3.1MEDIUM 5.3
- TI-2020-10091 An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. CVSS 3.1HIGH 8.8
- TI-2020-10090 An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. CVSS 3.1HIGH 8.8
- TI-2019-14184 OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials… CVSS 3.1HIGH 8.8
- TI-2020-10089 An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. CVSS 3.1HIGH 8.8
- TI-2014-02273 The V3 API in OpenStack Identity (Keystone) 2013.1 before 2013.2.4 and icehouse before… CVSS 2.0HIGH 7.8
Sources
- CVE-2021-38155 · CVE Program
- CVE-2021-38155 · NVD
- FIRST EPSS
- GHSA-4225-97pr-rr52 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences