CVE-2020-12689
OpenStack Keystone EC2 and/or credential endpoints are not protected from a scoped context
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any user authenticated within a limited scope (trust/oauth/application credential) can create an EC2 credential with an escalated permission, such as obtaining admin while the user is on a limited viewer role. This potentially allows a malicious user to act as the admin on a project another user has the admin role on, which can effectively grant that user global admin privileges.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any user authenticated within a limited scope (trust/oauth/application credential) can create an EC2 credential with an escalated permission, such as obtaining admin while the user is on a limited viewer role. This potentially allows a malicious user to act as the admin on a project another user has the admin role on, which can effectively grant that user global admin privileges.
- Record
CVE-2020-12689- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-269
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any user authenticated within a limited scope (trust/oauth/application credential) can create an EC2 credential with an escalated permission, such as obtaining admin while the user is on a limited viewer role. This potentially allows a malicious user to act as the admin on a project another user has the admin role on, which can effectively grant that user global admin privileges.
- Record
CVE-2020-12689- Updated
- 2026-11-02
EUVDEUVD-2020-0095 No score
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any user authenticated within a limited scope (trust/oauth/application credential) can create an EC2 credential with an escalated permission, such as obtaining admin while the user is on a limited viewer role. This potentially allows a malicious user to act as the admin on a project another user has the admin role on, which can effectively grant that user global admin privileges.
- Record
EUVD-2020-0095- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-chgw-36xv-47cw
OpenStack Keystone EC2 and/or credential endpoints are not protected from a scoped context
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any user authenticated within a limited scope (trust/oauth/application credential) can create an EC2 credential with an escalated permission, such as obtaining admin while the user is on a limited viewer role. This potentially allows a malicious user to act as the admin on a project another user has the admin role on, which can effectively grant that user global admin privileges.
- Record
GHSA-chgw-36xv-47cw- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-269
- Updated
- 2026-11-02
OSV
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any user authenticated within a limited scope (trust/oauth/application credential) can create an EC2 credential with an escalated permission, such as obtaining admin while the user is on a limited viewer role. This potentially allows a malicious user to act as the admin on a project another user has the admin role on, which can effectively grant that user global admin privileges.
- Record
CVE-2020-12689- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-12689
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any user authenticated within a limited scope (trust/oauth/application credential) can create an EC2 credential with an escalated permission, such as obtaining admin while the user is on a limited viewer role. This potentially allows a malicious user to act as the admin on a project another user has the admin role on, which can effectively grant that user global admin privileges.
- Record
DEBIAN-CVE-2020-12689- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 8 moreShow less
OSVGHSA-chgw-36xv-47cw
OpenStack Keystone EC2 and/or credential endpoints are not protected from a scoped context
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any user authenticated within a limited scope (trust/oauth/application credential) can create an EC2 credential with an escalated permission, such as obtaining admin while the user is on a limited viewer role. This potentially allows a malicious user to act as the admin on a project another user has the admin role on, which can effectively grant that user global admin privileges.
- Record
GHSA-chgw-36xv-47cw- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-269
- Updated
- 2026-11-02
OSVRHSA-2020:2732
Red Hat Security Advisory: openstack-keystone security update
- Record
RHSA-2020:2732- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2020:3096
Red Hat Security Advisory: openstack-keystone security update
- Record
RHSA-2020:3096- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2020:3102
Red Hat Security Advisory: openstack-keystone security update
- Record
RHSA-2020:3102- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2020:3105
Red Hat Security Advisory: openstack-keystone security update
- Record
RHSA-2020:3105- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-12689
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any user authenticated within a limited scope (trust/oauth/application credential) can create an EC2 credential with an escalated permission, such as obtaining admin while the user is on a limited viewer role. This potentially allows a malicious user to act as the admin on a project another user has the admin role on, which can effectively grant that user global admin privileges.
- Record
UBUNTU-CVE-2020-12689- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVPYSEC-2020-53 No score
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any user authenticated within a limited scope (trust/oauth/application credential) can create an EC2 credential with an escalated permission, such as obtaining admin while the user is on a limited viewer role. This potentially allows a malicious user to act as the admin on a project another user has the admin role on, which can effectively grant that user global admin privileges.
- Record
PYSEC-2020-53- Updated
- 2026-11-02
OSVUSN-4480-1 No score
keystone vulnerabilities
It was discovered that OpenStack Keystone incorrectly handled EC2 credentials. An authenticated attacker with a limited scope could possibly create EC2 credentials with escalated permissions. (CVE-2020-12689, CVE-2020-12691)
It was discovered that OpenStack Keystone incorrectly handled the list of roles provided with OAuth1 access tokens. An authenticated user could possibly end up with more role assignments than intended. (CVE-2020-12690)
It was discovered that OpenStack Keystone incorrectly handled EC2 signature TTL checks. A remote attacker could possibly use this issue to reuse Authorization headers. (CVE-2020-12692)
- Record
USN-4480-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
keystonePyPI |
before 15.0.1 | 15.0.1 |
keystonePyPI |
16.0.0 to 16.0.0 | 16.0.1 |
keystoneDebian:12 |
before 2:17.0.0~rc2-1 | 2:17.0.0~rc2-1 |
keystoneDebian:13 |
before 2:17.0.0~rc2-1 | 2:17.0.0~rc2-1 |
keystoneDebian:14 |
before 2:17.0.0~rc2-1 | 2:17.0.0~rc2-1 |
keystoneDebian:10 From an advisory covering 4 CVEs |
before 2:14.2.0-0+deb10u1, plus listed versions 2:14.0.1-2 |
2:14.2.0-0+deb10u1 |
keystonePyPI |
before 15.0.1, plus listed versions 12.0.212.0.313.0.213.0.313.0.4 Show 7 moreShow less14.0.014.0.114.1.014.2.015.0.015.0.0.0rc115.0.0.0rc2 |
15.0.1 |
keystonePyPI |
16.0.0 up to 16.0.1 | 16.0.1 |
openstack-keystoneRed Hat:openstack:13::el7 From an advisory covering 3 CVEs |
before 1:13.0.4-3.el7ost | 1:13.0.4-3.el7ost |
python-keystoneRed Hat:openstack:13::el7 From an advisory covering 3 CVEs |
before 1:13.0.4-3.el7ost | 1:13.0.4-3.el7ost |
Show 10 moreShow less
| Package | Affected | Fixed |
|---|---|---|
openstack-keystoneRed Hat:openstack:10::el7 From an advisory covering 2 CVEs |
before 1:10.0.3-8.el7ost | 1:10.0.3-8.el7ost |
python-keystoneRed Hat:openstack:10::el7 From an advisory covering 2 CVEs |
before 1:10.0.3-8.el7ost | 1:10.0.3-8.el7ost |
python-keystone-testsRed Hat:openstack:10::el7 From an advisory covering 2 CVEs |
before 1:10.0.3-8.el7ost | 1:10.0.3-8.el7ost |
openstack-keystoneRed Hat:openstack:15::el8 From an advisory covering 4 CVEs |
before 1:15.0.1-0.20200512110437.95b2bbe.el8ost | 1:15.0.1-0.20200512110437.95b2bbe.el8ost |
python3-keystoneRed Hat:openstack:15::el8 From an advisory covering 4 CVEs |
before 1:15.0.1-0.20200512110437.95b2bbe.el8ost | 1:15.0.1-0.20200512110437.95b2bbe.el8ost |
openstack-keystoneRed Hat:openstack:16::el8 From an advisory covering 4 CVEs |
before 1:16.0.1-0.20200511063421.40cbb7b.el8ost | 1:16.0.1-0.20200511063421.40cbb7b.el8ost |
python3-keystoneRed Hat:openstack:16::el8 From an advisory covering 4 CVEs |
before 1:16.0.1-0.20200511063421.40cbb7b.el8ost | 1:16.0.1-0.20200511063421.40cbb7b.el8ost |
keystoneUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2:8.0.0-0ubuntu12:9.0.0~b1-0ubuntu12:9.0.0~b2-0ubuntu12:9.0.0~b3-0ubuntu12:9.0.0~rc1-0ubuntu1 Show 11 moreShow less2:9.0.0-0ubuntu12:9.0.2-0ubuntu12:9.0.2-0ubuntu22:9.1.0-0ubuntu12:9.2.0-0ubuntu12:9.3.0-0ubuntu12:9.3.0-0ubuntu22:9.3.0-0ubuntu32:9.3.0-0ubuntu3.12:9.3.0-0ubuntu3.22:9.3.0-0ubuntu3.2+esm2 |
None known |
keystoneUbuntu:18.04:LTS |
before 2:13.0.4-0ubuntu1, plus listed versions 2:12.0.0-0ubuntu12:13.0.0~b1-0ubuntu12:13.0.0~b2-0ubuntu12:13.0.0~b3-0ubuntu12:13.0.0~rc1-0ubuntu1 Show 5 moreShow less2:13.0.0~rc2-0ubuntu12:13.0.0-0ubuntu12:13.0.1-0ubuntu12:13.0.2-0ubuntu12:13.0.2-0ubuntu3 |
2:13.0.4-0ubuntu1 |
keystoneUbuntu:18.04:LTS From an advisory covering 4 CVEs |
before 2:13.0.4-0ubuntu1, plus listed versions 2:12.0.0-0ubuntu12:13.0.0~b1-0ubuntu12:13.0.0~b2-0ubuntu12:13.0.0~b3-0ubuntu12:13.0.0~rc1-0ubuntu1 Show 5 moreShow less2:13.0.0~rc2-0ubuntu12:13.0.0-0ubuntu12:13.0.1-0ubuntu12:13.0.2-0ubuntu12:13.0.2-0ubuntu3 |
2:13.0.4-0ubuntu1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-12689 is a high vulnerability (CVSS 8.8) in Openstack Keystone, published May 6, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.56%, the 75th percentile. Fixed in keystone 15.0.1.
References
security.openstack.org/ossa/OSSA-2020-004.html
bugs.launchpad.net/keystone/+bug/1872735
openwall.com/lists/oss-security/2020/05/06/5
lists.apache.org/thread.html/re4ffc55cd2f1b55a26e07c83b3c22c3fe4bae6054d000a57fb48d8c2%40%3Ccommits.druid.apache.org%3E
usn.ubuntu.com/4480-1
Show 39 moreShow less
nvd.nist.gov/vuln/detail/CVE-2020-12689
github.com/openstack/keystone/commit/37e9907a176dad6843819b1bec4946c3aecc4548
security-tracker.debian.org/tracker/CVE-2020-12689
access.redhat.com/errata/RHSA-2020:2732
bugzilla.redhat.com/show_bug.cgi?id=1830384
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2732.json
cve.org/CVERecord?id=CVE-2020-12689
ubuntu.com/security/CVE-2020-12689