Openstack Keystone vulnerabilities

• openstack keystonemiddleware In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a... CVE-2026-115642 Fix available 8.3 HighOctober 30, 2026
• openstack keystone An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated... CVE-2026-90460 Fix available 7.6 HighSeptember 11, 2026
• openstack keystone In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project... CVE-2026-80183 Fix available 7.1 HighAugust 26, 2026
• openstack keystone In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms ... CVE-2026-80184 Fix available 7.6 HighAugust 25, 2026
• openstack keystone In OpenStack Keystone before 29.0.3, tokens obtained via OAuth1 access token, application... CVE-2026-80182 Fix available 7.6 HighAugust 25, 2026
• keystonejs keystone Keystone: `graphql.maxTake` bypass with negative `take` CVE-2026-63421 Fix available 7.5 HighAugust 21, 2026
• keystonejs keystone keystonejs keystone GraphQL API Endpoint output-field.ts resource consumption CVE-2026-10802 5.3 MediumJune 4, 2026
• openstack keystone OpenStack Keystone's federated token rescoping mechanism doesn't propagate the original token's expiry to the newly issued token CVE-2026-44394 Fix available 6.0 MediumMay 28, 2026
• openstack keystone, red hat openstack platform 13 (queens), openstack platform 16.2 +2 more +4 more OpenStack Keystone has an Incorrect Authorization issue CVE-2026-43000 Fix available 6.0 MediumMay 28, 2026
• openstack keystone, red hat openstack platform 13 (queens), openstack platform 16.2 +2 more +4 more OpenStack Keystone has an Authorization Bypass CVE-2026-42999 Fix available 6.0 MediumMay 28, 2026
• openstack keystone OpenStack Keystone doesn't verify that the user supplied in the authentication request matches the owner of the application credential CVE-2026-42998 Fix available 6.0 MediumMay 28, 2026
• openstack keystone, red hat openstack platform 13 (queens), openstack platform 16.2 +3 more +5 more OpenStack Keystone has an Incorrect Authorization Issue CVE-2026-43001 Fix available 7.9 HighMay 1, 2026
• openstack keystone OpenStack Keystone: LDAP identity backend does not convert enabled attribute to boolean CVE-2026-40683 Fix available 7.7 HighApril 14, 2026
• openstack keystone OpenStack Keystone: Restricted application credentials can create EC2 credentials CVE-2026-33551 Fix available 3.5 LowApril 10, 2026
• keystonejs keystone @keystone-6/core: `isFilterable` bypass via `cursor` parameter in findMany CVE-2026-33326 Fix available 4.3 MediumMarch 19, 2026
• openstack keystonemiddleware, red hat openshift container platform 4.17, openshift container platform 4.18 +7 more +9 more An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and... CVE-2026-22797 Fix available 9.9 CriticalJanuary 19, 2026
• openstack keystone OpenStack Keystone allows /v3/ec2tokens or /v3/s3tokens request with valid AWS Signature to provide Keystone authorization. CVE-2025-65073 Fix available 7.5 HighNovember 4, 2025
• keystonejs keystone Keystone has an unintended `isFilterable` bypass that can be used as an oracle to match hidden fields CVE-2025-46720 Fix available 3.1 LowMay 5, 2025
• keystonejs keystone Conditionally missing authorization in @keystone-6/core CVE-2023-40027 Fix available 3.7 LowAugust 15, 2023
• keystonejs keystone @keystone-6/auth Open Redirect vulnerability CVE-2023-34247 Fix available 6.1 MediumJune 13, 2023
• keystonejs keystone NODE_ENV in Keystone defaults to development with esbuild CVE-2022-39382 Fix available 9.8 CriticalNovember 3, 2022
• keystonejs keystone @keystone-6/core vulnerable to field-level access-control bypass for multiselect field CVE-2022-39322 Fix available 9.1 CriticalOctober 18, 2022
• openstack keystone, [unknown] openstack-keystone, redhat openstack platform +2 more +4 more A flaw was found in OpenStack. The application credential tokens can be used even after they have... CVE-2022-2447 Fix available 6.6 MediumSeptember 1, 2022
• openstack keystone, debian linux, redhat openstack platform +2 more Openstack Keystone Incorrect Authorization vulnerability CVE-2021-3563 Fix available 7.4 HighAugust 26, 2022
• openstack keystone OpenStack Keystone allows information disclosure during account locking CVE-2021-38155 Fix available 7.5 HighAugust 6, 2021
• openstack keystone, canonical ubuntu linux +1 more OpenStack Keystone does not check signature TTL of the EC2 credential auth method CVE-2020-12692 Fix available 5.4 MediumMay 6, 2020
• openstack keystone, canonical ubuntu linux +1 more OpenStack Keystone V3 /credentials endpoint policy logic allows to change credentials owner or target project ID CVE-2020-12691 Fix available 8.8 HighMay 6, 2020
• openstack keystone Insufficient Session Expiration in OpenStack Keystone CVE-2020-12690 Fix available 8.8 HighMay 6, 2020
• openstack keystone, canonical ubuntu linux +1 more OpenStack Keystone EC2 and/or credential endpoints are not protected from a scoped context CVE-2020-12689 Fix available 8.8 HighMay 6, 2020
• openstack python-keystoneclient, debian linux, redhat openstack +2 more Insufficient Verification of Data Authenticity in python-keystoneclient CVE-2013-2167 Fix available 9.8 CriticalDecember 10, 2019
• openstack python-keystoneclient, debian linux, fedoraproject fedora +1 more +3 more Inadequate Encryption Strength in python-keystoneclient CVE-2013-2166 Fix available 9.8 CriticalDecember 10, 2019
• openstack keystone OpenStack Keystone Credential Leakage CVE-2019-19687 Fix available 8.8 HighDecember 9, 2019
• keystone, debian linux +1 more OpenStack Keystone: extremely long passwords can crash Keystone by exhausting stack space CVE-2012-1572 Fix available 7.5 HighNovember 12, 2019
• openstack compute, keystone, redhat openstack +1 more +3 more OpenStack Keystone and other components vulnerable to Improper Certificate Validation CVE-2013-2255 Fix available 5.9 MediumNovember 1, 2019
• openstack keystone ** DISPUTED ** OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because... CVE-2018-20170 Fix availableDisputed 5.3 MediumDecember 17, 2018
• openstack keystone, redhat openstack, debian linux +2 more In the Federation component of OpenStack Keystone before 11.0.4, 12.0.0, and 13.0.0, an... CVE-2018-14432 Fix available 5.3 MediumJuly 31, 2018
• openstack keystone, keystonemiddleware, oracle solaris +2 more OpenStack Identity Keystone and keystonemiddleware Insufficiently Protected Credentials CVE-2015-7546 Fix available 7.5 HighFebruary 3, 2016
• openstack keystone, oracle solaris +1 more OpenStack Keystone Logs Passwords CVE-2015-3646 Fix available 4.0 MediumMay 12, 2015
• openstack keystonemiddleware, python-keystoneclient, canonical ubuntu linux +2 more OpenStack keystonemiddleware and python-keystoneclient vulnerable to man-in-the-middle attacks CVE-2015-1852 Fix available 4.3 MediumApril 17, 2015
• openstack keystone OpenStack Identity Keystone Improper Privilege Management CVE-2014-0204 Fix available 6.5 MediumNovember 3, 2014
• openstack keystonemiddleware, python-keystoneclient +1 more OpenStack keystonemiddleware does not verify certificate CVE-2014-7144 Fix available 4.3 MediumOctober 2, 2014
• openstack keystone, redhat openstack, canonical ubuntu linux +2 more OpenStack Identity Keystone Exposure of Sensitive Information CVE-2014-3621 Fix available 4.0 MediumOctober 2, 2014
• openstack keystone, canonical ubuntu linux +1 more OpenStack Keystone Domain-scoped tokens don't get revoked CVE-2014-5253 Fix available 4.9 MediumAugust 15, 2014
• openstack keystone, canonical ubuntu linux +1 more OpenStack Identity (Keystone) UUID v2 tokens does not expire with revocation events CVE-2014-5252 Fix available 4.9 MediumAugust 15, 2014
• openstack keystone, canonical ubuntu linux +1 more OpenStack Identity (Keystone) Multiple vulnerabilities in revocation events CVE-2014-5251 Fix available 4.9 MediumAugust 15, 2014
• openstack keystone OpenStack Identity (Keystone) before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2... CVE-2014-3520 Fix available 6.5 MediumJuly 2, 2014
• openstack keystone, suse cloud +1 more OpenStack Identity Keystone is vulnerable to Block delegation escalation of privilege CVE-2014-3476 Fix available 6.0 MediumJune 17, 2014
• openstack keystone, fedoraproject fedora +1 more OpenStack Identity (Keystone) Denial of Service CVE-2013-2014 Fix available 5.0 MediumJune 2, 2014
• openstack keystone OpenStack Identity (Keystone) DoS through V3 API authentication chaining CVE-2014-2828 Fix available 7.8 HighApril 15, 2014
• openstack python-keystoneclient python-keystoneclient vulnerable to context confusion in Keystone auth_token middleware CVE-2014-0105 Fix available 6.0 MediumApril 15, 2014
• Show olderLoading…