CVE-2020-12690
Insufficient Session Expiration in OpenStack Keystone
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access.
- Record
CVE-2020-12690- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-613
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access.
- Record
CVE-2020-12690- Updated
- 2026-11-02
EUVDEUVD-2020-0096 No score
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access.
- Record
EUVD-2020-0096- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6m8p-x4qw-gh5j
Insufficient Session Expiration in OpenStack Keystone
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access.
- Record
GHSA-6m8p-x4qw-gh5j- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-613
- Updated
- 2026-11-02
OSV
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access.
- Record
CVE-2020-12690- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-12690
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access.
- Record
DEBIAN-CVE-2020-12690- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 6 moreShow less
OSVGHSA-6m8p-x4qw-gh5j
Insufficient Session Expiration in OpenStack Keystone
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access.
- Record
GHSA-6m8p-x4qw-gh5j- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-613
- Updated
- 2026-11-02
OSVRHSA-2020:3102
Red Hat Security Advisory: openstack-keystone security update
- Record
RHSA-2020:3102- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2020:3105
Red Hat Security Advisory: openstack-keystone security update
- Record
RHSA-2020:3105- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-12690
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access.
- Record
UBUNTU-CVE-2020-12690- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVPYSEC-2020-54 No score
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access.
- Record
PYSEC-2020-54- Updated
- 2026-11-02
OSVUSN-4480-1 No score
keystone vulnerabilities
It was discovered that OpenStack Keystone incorrectly handled EC2 credentials. An authenticated attacker with a limited scope could possibly create EC2 credentials with escalated permissions. (CVE-2020-12689, CVE-2020-12691)
It was discovered that OpenStack Keystone incorrectly handled the list of roles provided with OAuth1 access tokens. An authenticated user could possibly end up with more role assignments than intended. (CVE-2020-12690)
It was discovered that OpenStack Keystone incorrectly handled EC2 signature TTL checks. A remote attacker could possibly use this issue to reuse Authorization headers. (CVE-2020-12692)
- Record
USN-4480-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
keystonePyPI |
before 15.0.1 | 15.0.1 |
keystonePyPI |
16.0.0.0rc1 up to 16.0.0 | 16.0.0 |
keystoneDebian:12 |
before 2:17.0.0~rc2-1 | 2:17.0.0~rc2-1 |
keystoneDebian:13 |
before 2:17.0.0~rc2-1 | 2:17.0.0~rc2-1 |
keystoneDebian:14 |
before 2:17.0.0~rc2-1 | 2:17.0.0~rc2-1 |
keystoneDebian:10 From an advisory covering 4 CVEs |
before 2:14.2.0-0+deb10u1, plus listed versions 2:14.0.1-2 |
2:14.2.0-0+deb10u1 |
keystonePyPI |
before 15.0.1, plus listed versions 12.0.212.0.313.0.213.0.313.0.4 Show 7 moreShow less14.0.014.0.114.1.014.2.015.0.015.0.0.0rc115.0.0.0rc2 |
15.0.1 |
keystonePyPI |
16.0.0.0rc1 up to 16.0.0, plus listed versions 16.0.0.0rc2 |
16.0.0 |
keystonePyPI |
before 15.0.1, plus listed versions 12.0.212.0.313.0.213.0.313.0.4 Show 7 moreShow less14.0.014.0.114.1.014.2.015.0.0.0rc115.0.0.0rc215.0.0 |
15.0.1 |
openstack-keystoneRed Hat:openstack:15::el8 From an advisory covering 4 CVEs |
before 1:15.0.1-0.20200512110437.95b2bbe.el8ost | 1:15.0.1-0.20200512110437.95b2bbe.el8ost |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python3-keystoneRed Hat:openstack:15::el8 From an advisory covering 4 CVEs |
before 1:15.0.1-0.20200512110437.95b2bbe.el8ost | 1:15.0.1-0.20200512110437.95b2bbe.el8ost |
openstack-keystoneRed Hat:openstack:16::el8 From an advisory covering 4 CVEs |
before 1:16.0.1-0.20200511063421.40cbb7b.el8ost | 1:16.0.1-0.20200511063421.40cbb7b.el8ost |
python3-keystoneRed Hat:openstack:16::el8 From an advisory covering 4 CVEs |
before 1:16.0.1-0.20200511063421.40cbb7b.el8ost | 1:16.0.1-0.20200511063421.40cbb7b.el8ost |
keystoneUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2:8.0.0-0ubuntu12:9.0.0~b1-0ubuntu12:9.0.0~b2-0ubuntu12:9.0.0~b3-0ubuntu12:9.0.0~rc1-0ubuntu1 Show 11 moreShow less2:9.0.0-0ubuntu12:9.0.2-0ubuntu12:9.0.2-0ubuntu22:9.1.0-0ubuntu12:9.2.0-0ubuntu12:9.3.0-0ubuntu12:9.3.0-0ubuntu22:9.3.0-0ubuntu32:9.3.0-0ubuntu3.12:9.3.0-0ubuntu3.22:9.3.0-0ubuntu3.2+esm2 |
None known |
keystoneUbuntu:18.04:LTS |
before 2:13.0.4-0ubuntu1, plus listed versions 2:12.0.0-0ubuntu12:13.0.0~b1-0ubuntu12:13.0.0~b2-0ubuntu12:13.0.0~b3-0ubuntu12:13.0.0~rc1-0ubuntu1 Show 5 moreShow less2:13.0.0~rc2-0ubuntu12:13.0.0-0ubuntu12:13.0.1-0ubuntu12:13.0.2-0ubuntu12:13.0.2-0ubuntu3 |
2:13.0.4-0ubuntu1 |
keystoneUbuntu:18.04:LTS From an advisory covering 4 CVEs |
before 2:13.0.4-0ubuntu1, plus listed versions 2:12.0.0-0ubuntu12:13.0.0~b1-0ubuntu12:13.0.0~b2-0ubuntu12:13.0.0~b3-0ubuntu12:13.0.0~rc1-0ubuntu1 Show 5 moreShow less2:13.0.0~rc2-0ubuntu12:13.0.0-0ubuntu12:13.0.1-0ubuntu12:13.0.2-0ubuntu12:13.0.2-0ubuntu3 |
2:13.0.4-0ubuntu1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-12690 is a high vulnerability (CVSS 8.8) in Openstack Keystone, published May 6, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.90%, the 79th percentile. Fixed in keystone 15.0.1.
References
security.openstack.org/ossa/OSSA-2020-005.html
bugs.launchpad.net/keystone/+bug/1873290
openwall.com/lists/oss-security/2020/05/06/6
lists.apache.org/thread.html/re4ffc55cd2f1b55a26e07c83b3c22c3fe4bae6054d000a57fb48d8c2%40%3Ccommits.druid.apache.org%3E
usn.ubuntu.com/4480-1
Show 34 moreShow less
nvd.nist.gov/vuln/detail/CVE-2020-12690
github.com/advisories/GHSA-6m8p-x4qw-gh5j
security-tracker.debian.org/tracker/CVE-2020-12690
access.redhat.com/errata/RHSA-2020:3102
bugzilla.redhat.com/show_bug.cgi?id=1830384
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3102.json
cve.org/CVERecord?id=CVE-2020-12689
ubuntu.com/security/CVE-2020-12690