Every CVE Search/ Get API key

CVE-2017-2673

OpenStack Identity service (keystone) Incorrect Authorization

6.8 MediumFix available

An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service (keystone). An authenticated federated user could request permissions to a project and unintentionally be granted all related roles including administrative roles.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

2.30%Up 0.8 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 6.8

An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service (keystone). An authenticated federated user could request permissions to a project and unintentionally be granted all related roles including administrative roles.

Record
CVE-2017-2673
CVSS 3.0
6.8 MediumCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-863
Updated
2026-11-02
EUVDEUVD-2018-0083 6.8

An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service (keystone). An authenticated federated user could request permissions to a project and unintentionally be granted all related roles including administrative roles.

Record
EUVD-2018-0083
CVSS 3.0
6.8 MediumCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-j36m-hv43-7w7m 8.6

OpenStack Identity service (keystone) Incorrect Authorization

An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service (keystone). An authenticated federated user could request permissions to a project and unintentionally be granted all related roles including administrative roles.

Record
GHSA-j36m-hv43-7w7m
CVSS 4.0
8.6 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.0
7.2 HighCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-863
Updated
2026-11-02
NVD 6.8

An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service (keystone). An authenticated federated user could request permissions to a project and unintentionally be granted all related roles including administrative roles.

Record
CVE-2017-2673
CVSS 3.0
6.8 MediumCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS 3.0
7.2 HighCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
6.5 MediumAV:N/AC:L/Au:S/C:P/I:P/A:P
Weakness
CWE-863
Updated
2026-11-02
OSV 7.2

An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service (keystone). An authenticated federated user could request permissions to a project and unintentionally be granted all related roles including administrative roles.

Record
CVE-2017-2673
CVSS 3.0
7.2 HighCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2017-2673 7.2

An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service (keystone). An authenticated federated user could request permissions to a project and unintentionally be granted all related roles including administrative roles.

Record
DEBIAN-CVE-2017-2673
CVSS 3.0
7.2 HighCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 6 moreShow less
OSVGHSA-j36m-hv43-7w7m 8.6

OpenStack Identity service (keystone) Incorrect Authorization

An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service (keystone). An authenticated federated user could request permissions to a project and unintentionally be granted all related roles including administrative roles.

Record
GHSA-j36m-hv43-7w7m
CVSS 4.0
8.6 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.0
7.2 HighCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-863
Updated
2026-11-02
OSVPYSEC-2018-152 7.2

An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service (keystone). An authenticated federated user could request permissions to a project and unintentionally be granted all related roles including administrative roles.

Record
PYSEC-2018-152
CVSS 3.0
7.2 HighCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2017:1461 6.8

Red Hat Security Advisory: openstack-keystone security, bug fix, and enhancement update

Record
RHSA-2017:1461
CVSS 3.0
6.8 MediumCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2017:1597 6.8

Red Hat Security Advisory: openstack-keystone security, bug fix, and enhancement update

Record
RHSA-2017:1597
CVSS 3.0
6.8 MediumCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2017-2673 7.2

An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service (keystone). An authenticated federated user could request permissions to a project and unintentionally be granted all related roles including administrative roles.

Record
UBUNTU-CVE-2017-2673
CVSS 3.0
7.2 HighCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0
6.8 MediumCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVUSN-3448-1 No score

keystone vulnerability

Boris Bobrov discovered that OpenStack Keystone incorrectly handled federation mapping when there are rules in which group-based assignments are not used. A remote authenticated user may receive all the roles assigned to a project regardless of the federation mapping, contrary to expectations.

Record
USN-3448-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
keystone
PyPI
 9.0.0 to 9.3.0 None known
keystone
PyPI
 10.0.0 to 10.0.1
10.0.2
keystone
PyPI
 11.0.0 to 11.0.0
11.0.1
keystone
Debian:12
 before 2:10.0.0-9
2:10.0.0-9
keystone
Debian:13
 before 2:10.0.0-9
2:10.0.0-9
keystone
Debian:14
 before 2:10.0.0-9
2:10.0.0-9
keystone
PyPI
 10.0.0 up to 10.0.2
10.0.2
keystone
PyPI
 11.0.0 up to 11.0.1
11.0.1
keystone
PyPI
 9.0.0 up to 10.0.2, 11.0.0 up to 11.0.1
10.0.211.0.1
openstack-keystone
Red Hat:openstack:9::el7
 before 1:9.3.0-2.el7ost
1:9.3.0-2.el7ost
Show 6 moreShow less
Affected packages
PackageAffectedFixed
python-keystone
Red Hat:openstack:9::el7
 before 1:9.3.0-2.el7ost
1:9.3.0-2.el7ost
python-keystone-tests
Red Hat:openstack:9::el7
 before 1:9.3.0-2.el7ost
1:9.3.0-2.el7ost
openstack-keystone
Red Hat:openstack:10::el7
 before 1:10.0.1-3.el7ost
1:10.0.1-3.el7ost
python-keystone
Red Hat:openstack:10::el7
 before 1:10.0.1-3.el7ost
1:10.0.1-3.el7ost
python-keystone-tests
Red Hat:openstack:10::el7
 before 1:10.0.1-3.el7ost
1:10.0.1-3.el7ost
keystone
Ubuntu:16.04:LTS
 before 2:9.3.0-0ubuntu3.1, plus listed versions
2:8.0.0-0ubuntu12:9.0.0~b1-0ubuntu12:9.0.0~b2-0ubuntu12:9.0.0~b3-0ubuntu12:9.0.0~rc1-0ubuntu1
Show 8 moreShow less
2:9.0.0-0ubuntu12:9.0.2-0ubuntu12:9.0.2-0ubuntu22:9.1.0-0ubuntu12:9.2.0-0ubuntu12:9.3.0-0ubuntu12:9.3.0-0ubuntu22:9.3.0-0ubuntu3
2:9.3.0-0ubuntu3.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-2673 is a medium vulnerability (CVSS 6.8) in Redhat Openstack, published April 27, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.30%, the 83rd percentile. Fixed in keystone 10.0.2.

References

Show 19 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open