Vulnerabilities

TI-2026-32344 CVE-2026-44394 · GHSA-whqr-fgm5-x77q

Incorrect authorization in OpenStack Keystone

LOW 35

An issue was discovered in OpenStack Keystone before 29.0.2.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00249 Published 2026-05-28 Partial fix · 27.0.2, 28.0.2 +1 CWE-863

TI-2026-31180 CVE-2026-43000 · GHSA-q623-f4j4-p4xj

Incorrect authorization in OpenStack Keystone

LOW 38

An issue was discovered in OpenStack Keystone before 29.0.2.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00328 Published 2026-05-28 Partial fix · 27.0.2, 28.0.2 +1 CWE-863

TI-2026-31179 CVE-2026-42999 · GHSA-2r23-2g6v-2m5f

Incorrect authorization in OpenStack Keystone

LOW 38

An issue was discovered in OpenStack Keystone before 29.0.2.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00329 Published 2026-05-28 Partial fix · 27.0.2, 28.0.2 +1 CWE-863

TI-2026-31178 CVE-2026-42998 · GHSA-8f8m-wrvr-wcvf

Incorrect authorization in OpenStack Keystone

LOW 38

An issue was discovered in OpenStack Keystone before 29.0.2.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00303 Published 2026-05-28 Partial fix · 27.0.2, 28.0.2 +1 CWE-863

TI-2026-31181 CVE-2026-43001 · GHSA-hhq2-3832-xxcv

Incorrect authorization in OpenStack Keystone

LOW 35

An issue was discovered in OpenStack Keystone before 29.0.2.

CVSS 3.1HIGH 8.0 Network High privileges No interaction EPSS 0.00466 Published 2026-05-01 Fixed in 27.0.2, 28.0.2 +1 CWE-863

TI-2026-25942 CVE-2026-33551 · GHSA-4phw-6824-6cfp

Incorrect authorization in OpenStack Keystone

MEDIUM 57

An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0.

CVSS 3.1MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00228 Published 2026-04-10 Fixed in 26.1.1 CWE-863

TI-2022-02260 CVE-2022-2447 · GHSA-r88f-774m-5rj4

A flaw was found in Keystone.

LOW 30

A flaw was found in Keystone.

CVSS 3.1MEDIUM 6.6 Network High privileges No interaction EPSS 0.00719 Published 2022-09-01 No fix listed CWE-324

TI-2021-02513 CVE-2021-3563 · GHSA-cc99-whm5-mmq3

Incorrect authorization in keystone

LOW 36

A flaw was found in openstack-keystone.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.01863 Published 2022-08-26 No fix listed CWE-863

TI-2021-15835 CVE-2021-38155 · GHSA-4225-97pr-rr52

OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before…

LOW 38

OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclosure during account locking (related to PCI DSS features).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02478 Published 2021-08-06 Fixed in 16.0.2, 17.0.1 +2 CWE-307

TI-2020-10089 CVE-2020-12689 · GHSA-chgw-36xv-47cw

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0.

MEDIUM 41

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01562 Published 2020-05-06 Partial fix · 15.0.1, 16.0.1 CWE-269

TI-2020-10090 CVE-2020-12690 · GHSA-6m8p-x4qw-gh5j

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0.

MEDIUM 42

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01896 Published 2020-05-06 Partial fix · 15.0.1, 16.0.0 CWE-613

TI-2020-10091 CVE-2020-12691 · GHSA-4427-7f3w-mqv6

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0.

MEDIUM 46

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.04918 Published 2020-05-06 Partial fix · 15.0.1, 16.0.1 CWE-863

TI-2020-10092 CVE-2020-12692 · GHSA-rqw2-hhrf-7936

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0.

LOW 26

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00705 Published 2020-05-06 Partial fix · 16.0.0, 15.0.1 CWE-294

TI-2019-14184 CVE-2019-19687 · GHSA-2j23-fwqm-mgwr

OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials…

MEDIUM 42

OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0178 Published 2019-12-09 Fixed in 15.0.1, 16.0.1 CWE-522

TI-2012-01364 CVE-2012-1572 · GHSA-6xjx-jphh-cf8v

OpenStack Keystone: extremely long passwords can crash Keystone by exhausting stack space

LOW 35

OpenStack Keystone: extremely long passwords can crash Keystone by exhausting stack space

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01199 Published 2019-11-12 No fix listed CWE-400

TI-2013-02015 CVE-2013-2255 · GHSA-qh2x-hpf9-cf2g

Improper certificate validation in OpenStack Keystone

LOW 28

HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side SSL certificates.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.0097 Published 2019-11-01 Partial fix · 0.4.0, 7.0.0a0 +1 CWE-295

TI-2018-14292 CVE-2018-20170 · GHSA-jpv2-hwjh-97c7

OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because invalid…

LOW 32

OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because invalid usernames have much faster responses than valid ones for a POST /v3/auth/tokens request.

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.0112 Published 2018-12-17 No fix listed CWE-200

TI-2018-10346 CVE-2018-14432 · GHSA-v25x-mmfh-g7w6

In the Federation component of OpenStack Keystone before 11.0.4, 12.0.0, and 13.0.0, an…

LOW 27

In the Federation component of OpenStack Keystone before 11.0.4, 12.0.0, and 13.0.0, an authenticated "GET /v3/OS-FEDERATION/projects" request may bypass intended access restrictions on listing projects.

CVSS 3.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.01597 Published 2018-07-31 Fixed CWE-200

TI-2015-06273 CVE-2015-7546 · GHSA-8c4w-v65p-jvcv

The identity service in OpenStack Identity (Keystone) before 2015.1.3 (Kilo) and 8.0.x…

LOW 37

The identity service in OpenStack Identity (Keystone) before 2015.1.3 (Kilo) and 8.0.x before 8.0.2 (Liberty) and keystonemiddleware (formerly python-keystoneclient) before 1.5.4 (Kilo) and Liberty before 2.3.3 does not…

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.01997 Published 2016-02-03 Partial fix · 9.0.0.0b2, 4.1.0 +3 CWE-522

TI-2015-03085 CVE-2015-3646 · GHSA-jwpw-ppj5-7h4w

OpenStack Identity (Keystone) before 2014.1.5 and 2014.2.x before 2014.2.4 logs the…

LOW 24

OpenStack Identity (Keystone) before 2014.1.5 and 2014.2.x before 2014.2.4 logs the backend_argument configuration option content, which allows remote authenticated users to obtain passwords and other sensitive backend i…

CVSS 2.0MEDIUM 4.0 Network Low privileges Interaction — EPSS 0.0288 Published 2015-05-12 Partial fix · 2014.1.5, 2014.2.4 CWE-200

TI-2014-00197 CVE-2014-0204 · GHSA-c4p9-87h3-7vr4

OpenStack Identity (Keystone) before 2014.1.1 does not properly handle when a role is…

LOW 32

OpenStack Identity (Keystone) before 2014.1.1 does not properly handle when a role is assigned to a group that has the same ID as a user, which allows remote authenticated users to gain privileges that are assigned to a…

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.01397 Published 2014-11-03 Fixed in 8.0.0a0 CWE-269

TI-2014-02846 CVE-2014-3520 · GHSA-mv96-4gm9-mjhw

OpenStack Identity (Keystone) before 2013.2.4, 2014.x before 2014.1.2, and Juno before…

LOW 33

OpenStack Identity (Keystone) before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2 allows remote authenticated trustees to gain access to an unauthorized project for which the trustor has certain roles via the…

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.01907 Published 2014-10-26 Partial fix CWE-863

TI-2014-02942 CVE-2014-3621 · GHSA-8v8f-vc72-pmhc

The catalog url replacement in OpenStack Identity (Keystone) before 2013.2.3 and 2014.1…

LOW 23

The catalog url replacement in OpenStack Identity (Keystone) before 2013.2.3 and 2014.1 before 2014.1.2.1 allows remote authenticated users to read sensitive configuration options via a crafted endpoint, as demonstrated…

CVSS 2.0MEDIUM 4.0 Network Low privileges Interaction — EPSS 0.02126 Published 2014-10-02 Fixed in 8.0.0a0 CWE-200

TI-2014-04288 CVE-2014-5253 · GHSA-77w8-qv8m-386h

OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 does not…

LOW 25

OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 does not properly revoke tokens when a domain is invalidated, which allows remote authenticated users to retain access via a domain-scoped t…

CVSS 2.0MEDIUM 4.9 Network Low privileges Interaction — EPSS 0.01488 Published 2014-08-25 Fixed in 8.0.0a0 CWE-255

TI-2014-04287 CVE-2014-5252 · GHSA-v8fq-gq9j-3v7h

The V3 API in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before…

LOW 26

The V3 API in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 updates the issued_at value for UUID v2 tokens, which allows remote authenticated users to bypass the token expiration and ret…

CVSS 2.0MEDIUM 4.9 Network Low privileges Interaction — EPSS 0.01515 Published 2014-08-25 Fixed in 8.0.0a0 CWE-255

Vulnerabilities

Filters