Every CVE Search/ Get API key

CVE-2019-19687

OpenStack Keystone Credential Leakage

8.8 HighFix available

OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.)

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.78%Down 0.1 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 8.8

OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.)

Record
CVE-2019-19687
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
3.5 LowAV:N/AC:M/Au:S/C:P/I:N/A:N
Weakness
CWE-522
Updated
2026-11-02
CVE List No score

OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.)

Record
CVE-2019-19687
Updated
2026-11-02
EUVDEUVD-2019-0072 No score

OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.)

Record
EUVD-2019-0072
Updated
2026-11-03
GitHub AdvisoriesGHSA-2j23-fwqm-mgwr 8.7

OpenStack Keystone Credential Leakage

OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.)

Record
GHSA-2j23-fwqm-mgwr
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-522
Updated
2026-11-02
OSV 8.8

OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.)

Record
CVE-2019-19687
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2019-19687 8.8

OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.)

Record
DEBIAN-CVE-2019-19687
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 5 moreShow less
OSVGHSA-2j23-fwqm-mgwr 8.7

OpenStack Keystone Credential Leakage

OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.)

Record
GHSA-2j23-fwqm-mgwr
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-522
Updated
2026-11-02
OSVRHEA-2020:0283 8.1

Red Hat Enhancement Advisory: Red Hat OpenStack Platform 16.0 GA

Record
RHEA-2020:0283
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2019:4358 8.1

Red Hat Security Advisory: openstack-keystone security update

Record
RHSA-2019:4358
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2019-19687 8.8

OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.)

Record
UBUNTU-CVE-2019-19687
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVPYSEC-2019-29 No score

OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.)

Record
PYSEC-2019-29
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
keystone
PyPI
 15.0.0 to 15.0.0
15.0.1
keystone
PyPI
 16.0.0 to 16.0.0
16.0.1
keystone
Debian:12
 before 2:16.0.0-5
2:16.0.0-5
keystone
Debian:13
 before 2:16.0.0-5
2:16.0.0-5
keystone
Debian:14
 before 2:16.0.0-5
2:16.0.0-5
keystone
PyPI
 15.0.0 up to 15.0.1
15.0.1
keystone
PyPI
 16.0.0 up to 16.0.1
16.0.1
keystone
PyPI
 before 16.0.1, plus listed versions
12.0.212.0.313.0.213.0.313.0.4
Show 11 moreShow less
14.0.014.0.114.1.014.2.015.0.015.0.0.0rc115.0.0.0rc215.0.116.0.016.0.0.0rc116.0.0.0rc2
16.0.1
openstack-mistral
Red Hat:openstack:16::el8
From an advisory covering 2 CVEs
 before 0:9.0.2-0.20191125120837.6651519.el8ost
0:9.0.2-0.20191125120837.6651519.el8ost
openstack-mistral-all
Red Hat:openstack:16::el8
From an advisory covering 2 CVEs
 before 0:9.0.2-0.20191125120837.6651519.el8ost
0:9.0.2-0.20191125120837.6651519.el8ost
Show 11 moreShow less
Affected packages
PackageAffectedFixed
openstack-mistral-api
Red Hat:openstack:16::el8
From an advisory covering 2 CVEs
 before 0:9.0.2-0.20191125120837.6651519.el8ost
0:9.0.2-0.20191125120837.6651519.el8ost
openstack-mistral-common
Red Hat:openstack:16::el8
From an advisory covering 2 CVEs
 before 0:9.0.2-0.20191125120837.6651519.el8ost
0:9.0.2-0.20191125120837.6651519.el8ost
openstack-mistral-engine
Red Hat:openstack:16::el8
From an advisory covering 2 CVEs
 before 0:9.0.2-0.20191125120837.6651519.el8ost
0:9.0.2-0.20191125120837.6651519.el8ost
openstack-mistral-event-engine
Red Hat:openstack:16::el8
From an advisory covering 2 CVEs
 before 0:9.0.2-0.20191125120837.6651519.el8ost
0:9.0.2-0.20191125120837.6651519.el8ost
openstack-mistral-executor
Red Hat:openstack:16::el8
From an advisory covering 2 CVEs
 before 0:9.0.2-0.20191125120837.6651519.el8ost
0:9.0.2-0.20191125120837.6651519.el8ost
openstack-mistral-notifier
Red Hat:openstack:16::el8
From an advisory covering 2 CVEs
 before 0:9.0.2-0.20191125120837.6651519.el8ost
0:9.0.2-0.20191125120837.6651519.el8ost
python3-mistral
Red Hat:openstack:16::el8
From an advisory covering 2 CVEs
 before 0:9.0.2-0.20191125120837.6651519.el8ost
0:9.0.2-0.20191125120837.6651519.el8ost
openstack-keystone
Red Hat:openstack:16::el8
From an advisory covering 2 CVEs
 before 1:16.0.1-0.20191210095025.bd3f637.el8ost
1:16.0.1-0.20191210095025.bd3f637.el8ost
python3-keystone
Red Hat:openstack:16::el8
From an advisory covering 2 CVEs
 before 1:16.0.1-0.20191210095025.bd3f637.el8ost
1:16.0.1-0.20191210095025.bd3f637.el8ost
openstack-keystone
Red Hat:openstack:15::el8
 before 1:15.0.1-0.20190720060412.5f27c4b.1.el8ost
1:15.0.1-0.20190720060412.5f27c4b.1.el8ost
python3-keystone
Red Hat:openstack:15::el8
 before 1:15.0.1-0.20190720060412.5f27c4b.1.el8ost
1:15.0.1-0.20190720060412.5f27c4b.1.el8ost

History

History
RecordedChangedSources
affected, facts
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-19687 is a high vulnerability (CVSS 8.8) in Openstack Keystone, published December 9, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.78%, the 78th percentile. Fixed in keystone 15.0.1.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 12 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open