CVE-2020-12691
OpenStack Keystone V3 /credentials endpoint policy logic allows to change credentials owner or target project ID
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any authenticated user can create an EC2 credential for themselves for a project that they have a specified role on, and then perform an update to the credential user and project, allowing them to masquerade as another user. This potentially allows a malicious user to act as the admin on a project another user has the admin role on, which can effectively grant that user global admin privileges.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any authenticated user can create an EC2 credential for themselves for a project that they have a specified role on, and then perform an update to the credential user and project, allowing them to masquerade as another user. This potentially allows a malicious user to act as the admin on a project another user has the admin role on, which can effectively grant that user global admin privileges.
- Record
CVE-2020-12691- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-863
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any authenticated user can create an EC2 credential for themselves for a project that they have a specified role on, and then perform an update to the credential user and project, allowing them to masquerade as another user. This potentially allows a malicious user to act as the admin on a project another user has the admin role on, which can effectively grant that user global admin privileges.
- Record
CVE-2020-12691- Updated
- 2026-11-02
EUVDEUVD-2020-0097 No score
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any authenticated user can create an EC2 credential for themselves for a project that they have a specified role on, and then perform an update to the credential user and project, allowing them to masquerade as another user. This potentially allows a malicious user to act as the admin on a project another user has the admin role on, which can effectively grant that user global admin privileges.
- Record
EUVD-2020-0097- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4427-7f3w-mqv6
OpenStack Keystone V3 /credentials endpoint policy logic allows to change credentials owner or target project ID
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any authenticated user can create an EC2 credential for themselves for a project that they have a specified role on, and then perform an update to the credential user and project, allowing them to masquerade as another user. This potentially allows a malicious user to act as the admin on a project another user has the admin role on, which can effectively grant that user global admin privileges.
- Record
GHSA-4427-7f3w-mqv6- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-311, CWE-863
- Updated
- 2026-11-02
OSV
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any authenticated user can create an EC2 credential for themselves for a project that they have a specified role on, and then perform an update to the credential user and project, allowing them to masquerade as another user. This potentially allows a malicious user to act as the admin on a project another user has the admin role on, which can effectively grant that user global admin privileges.
- Record
CVE-2020-12691- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-12691
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any authenticated user can create an EC2 credential for themselves for a project that they have a specified role on, and then perform an update to the credential user and project, allowing them to masquerade as another user. This potentially allows a malicious user to act as the admin on a project another user has the admin role on, which can effectively grant that user global admin privileges.
- Record
DEBIAN-CVE-2020-12691- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 8 moreShow less
OSVGHSA-4427-7f3w-mqv6
OpenStack Keystone V3 /credentials endpoint policy logic allows to change credentials owner or target project ID
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any authenticated user can create an EC2 credential for themselves for a project that they have a specified role on, and then perform an update to the credential user and project, allowing them to masquerade as another user. This potentially allows a malicious user to act as the admin on a project another user has the admin role on, which can effectively grant that user global admin privileges.
- Record
GHSA-4427-7f3w-mqv6- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-311, CWE-863
- Updated
- 2026-11-02
OSVRHSA-2020:2732
Red Hat Security Advisory: openstack-keystone security update
- Record
RHSA-2020:2732- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2020:3096
Red Hat Security Advisory: openstack-keystone security update
- Record
RHSA-2020:3096- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2020:3102
Red Hat Security Advisory: openstack-keystone security update
- Record
RHSA-2020:3102- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2020:3105
Red Hat Security Advisory: openstack-keystone security update
- Record
RHSA-2020:3105- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-12691
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any authenticated user can create an EC2 credential for themselves for a project that they have a specified role on, and then perform an update to the credential user and project, allowing them to masquerade as another user. This potentially allows a malicious user to act as the admin on a project another user has the admin role on, which can effectively grant that user global admin privileges.
- Record
UBUNTU-CVE-2020-12691- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVPYSEC-2020-55 No score
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any authenticated user can create an EC2 credential for themselves for a project that they have a specified role on, and then perform an update to the credential user and project, allowing them to masquerade as another user. This potentially allows a malicious user to act as the admin on a project another user has the admin role on, which can effectively grant that user global admin privileges.
- Record
PYSEC-2020-55- Updated
- 2026-11-02
OSVUSN-4480-1 No score
keystone vulnerabilities
It was discovered that OpenStack Keystone incorrectly handled EC2 credentials. An authenticated attacker with a limited scope could possibly create EC2 credentials with escalated permissions. (CVE-2020-12689, CVE-2020-12691)
It was discovered that OpenStack Keystone incorrectly handled the list of roles provided with OAuth1 access tokens. An authenticated user could possibly end up with more role assignments than intended. (CVE-2020-12690)
It was discovered that OpenStack Keystone incorrectly handled EC2 signature TTL checks. A remote attacker could possibly use this issue to reuse Authorization headers. (CVE-2020-12692)
- Record
USN-4480-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
keystonePyPI |
before 15.0.1 | 15.0.1 |
keystonePyPI |
16.0.0 to 16.0.0 | 16.0.1 |
keystoneDebian:12 |
before 2:17.0.0~rc2-1 | 2:17.0.0~rc2-1 |
keystoneDebian:13 |
before 2:17.0.0~rc2-1 | 2:17.0.0~rc2-1 |
keystoneDebian:14 |
before 2:17.0.0~rc2-1 | 2:17.0.0~rc2-1 |
keystoneDebian:10 From an advisory covering 4 CVEs |
before 2:14.2.0-0+deb10u1, plus listed versions 2:14.0.1-2 |
2:14.2.0-0+deb10u1 |
keystonePyPI |
before 15.0.1, plus listed versions 12.0.212.0.313.0.213.0.313.0.4 Show 7 moreShow less14.0.014.0.114.1.014.2.015.0.015.0.0.0rc115.0.0.0rc2 |
15.0.1 |
keystonePyPI |
16.0.0 up to 16.0.1 | 16.0.1 |
openstack-keystoneRed Hat:openstack:13::el7 From an advisory covering 3 CVEs |
before 1:13.0.4-3.el7ost | 1:13.0.4-3.el7ost |
python-keystoneRed Hat:openstack:13::el7 From an advisory covering 3 CVEs |
before 1:13.0.4-3.el7ost | 1:13.0.4-3.el7ost |
Show 10 moreShow less
| Package | Affected | Fixed |
|---|---|---|
openstack-keystoneRed Hat:openstack:10::el7 From an advisory covering 2 CVEs |
before 1:10.0.3-8.el7ost | 1:10.0.3-8.el7ost |
python-keystoneRed Hat:openstack:10::el7 From an advisory covering 2 CVEs |
before 1:10.0.3-8.el7ost | 1:10.0.3-8.el7ost |
python-keystone-testsRed Hat:openstack:10::el7 From an advisory covering 2 CVEs |
before 1:10.0.3-8.el7ost | 1:10.0.3-8.el7ost |
openstack-keystoneRed Hat:openstack:15::el8 From an advisory covering 4 CVEs |
before 1:15.0.1-0.20200512110437.95b2bbe.el8ost | 1:15.0.1-0.20200512110437.95b2bbe.el8ost |
python3-keystoneRed Hat:openstack:15::el8 From an advisory covering 4 CVEs |
before 1:15.0.1-0.20200512110437.95b2bbe.el8ost | 1:15.0.1-0.20200512110437.95b2bbe.el8ost |
openstack-keystoneRed Hat:openstack:16::el8 From an advisory covering 4 CVEs |
before 1:16.0.1-0.20200511063421.40cbb7b.el8ost | 1:16.0.1-0.20200511063421.40cbb7b.el8ost |
python3-keystoneRed Hat:openstack:16::el8 From an advisory covering 4 CVEs |
before 1:16.0.1-0.20200511063421.40cbb7b.el8ost | 1:16.0.1-0.20200511063421.40cbb7b.el8ost |
keystoneUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2:8.0.0-0ubuntu12:9.0.0~b1-0ubuntu12:9.0.0~b2-0ubuntu12:9.0.0~b3-0ubuntu12:9.0.0~rc1-0ubuntu1 Show 11 moreShow less2:9.0.0-0ubuntu12:9.0.2-0ubuntu12:9.0.2-0ubuntu22:9.1.0-0ubuntu12:9.2.0-0ubuntu12:9.3.0-0ubuntu12:9.3.0-0ubuntu22:9.3.0-0ubuntu32:9.3.0-0ubuntu3.12:9.3.0-0ubuntu3.22:9.3.0-0ubuntu3.2+esm2 |
None known |
keystoneUbuntu:18.04:LTS |
before 2:13.0.4-0ubuntu1, plus listed versions 2:12.0.0-0ubuntu12:13.0.0~b1-0ubuntu12:13.0.0~b2-0ubuntu12:13.0.0~b3-0ubuntu12:13.0.0~rc1-0ubuntu1 Show 5 moreShow less2:13.0.0~rc2-0ubuntu12:13.0.0-0ubuntu12:13.0.1-0ubuntu12:13.0.2-0ubuntu12:13.0.2-0ubuntu3 |
2:13.0.4-0ubuntu1 |
keystoneUbuntu:18.04:LTS From an advisory covering 4 CVEs |
before 2:13.0.4-0ubuntu1, plus listed versions 2:12.0.0-0ubuntu12:13.0.0~b1-0ubuntu12:13.0.0~b2-0ubuntu12:13.0.0~b3-0ubuntu12:13.0.0~rc1-0ubuntu1 Show 5 moreShow less2:13.0.0~rc2-0ubuntu12:13.0.0-0ubuntu12:13.0.1-0ubuntu12:13.0.2-0ubuntu12:13.0.2-0ubuntu3 |
2:13.0.4-0ubuntu1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-12691 is a high vulnerability (CVSS 8.8) in Openstack Keystone, published May 6, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.92%, the 92nd percentile. Fixed in keystone 15.0.1.
References
security.openstack.org/ossa/OSSA-2020-004.html
openwall.com/lists/oss-security/2020/05/06/5
bugs.launchpad.net/keystone/+bug/1872733
lists.apache.org/thread.html/re4ffc55cd2f1b55a26e07c83b3c22c3fe4bae6054d000a57fb48d8c2%40%3Ccommits.druid.apache.org%3E
usn.ubuntu.com/4480-1
Show 43 moreShow less
nvd.nist.gov/vuln/detail/CVE-2020-12691
github.com/openstack/keystone/commit/37e9907a176dad6843819b1bec4946c3aecc4548
security-tracker.debian.org/tracker/CVE-2020-12691
access.redhat.com/errata/RHSA-2020:2732
bugzilla.redhat.com/show_bug.cgi?id=1830384
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2732.json
cve.org/CVERecord?id=CVE-2020-12689
ubuntu.com/security/CVE-2020-12691