KE
Product
Keystone
49
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 18Medium 7Low 0
Watch
Add Keystone to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-43000 | 8.8 | May 28 | An issue was discovered in OpenStack Keystone before 29.0.2 Affected: 14.0.0 before 27.0.2; 28.0.0 before 28.0.2; 29.0.0 before 29.0.2 |
| CVE-2026-42998 | 8.8 | May 28 | An issue was discovered in OpenStack Keystone before 29.0.2 Affected: 14.0.0 before 27.0.2; 28.0.0 before 28.0.2; 29.0.0 before 29.0.2 |
| CVE-2026-42999 | 8.8 | May 28 | An issue was discovered in OpenStack Keystone before 29.0.2 Affected: 14.0.0 before 27.0.2; 28.0.0 before 28.0.2; 29.0.0 before 29.0.2 |
| CVE-2020-12691 | 8.8 | May 7 | An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0 Affected: before 15.0.1; 16.0.0 |
| CVE-2020-12690 | 8.8 | May 7 | An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0 Affected: before 15.0.1; 16.0.0 |
| CVE-2020-12689 | 8.8 | May 7 | An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0 Affected: before 15.0.1; 16.0.0 |
| CVE-2019-19687 | 8.8 | Dec 9 | OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API Affected: 15.0.0; 16.0.0 |
| CVE-2026-44394 | 8.1 | May 28 | An issue was discovered in OpenStack Keystone before 29.0.2 Affected: 14.0.0 before 27.0.2; 28.0.0 before 28.0.2; 29.0.0 before 29.0.2 |
| CVE-2026-43001 | 8.0 | May 1 | An issue was discovered in OpenStack Keystone before 29.0.2 Affected: 14.0.0 before 27.0.2; 28.0.0 before 28.0.2; 29.0.0 before 29.0.2 |
| CVE-2026-40683 | 7.7 | Apr 14 | In OpenStack Keystone before 28.0.1, the LDAP identity backend does not convert the user enabled attribute to a boolean when the user_enabled_invert configuration option is False… Affected: 8.0.0 before 25.0.1; 26.0.0 before 26.1.1; 27.0.0 before 27.0.1; 28.0.0 before 28.0.1 |
| CVE-2026-90460 | 7.6 | Sep 11 | An issue was discovered in OpenStack Keystone before 29.0.3 Affected: 13.0.0 before 27.0.3; 28.0.0 before 28.0.3; 29.0.0 before 29.0.3 |
| CVE-2026-80184 | 7.6 | Aug 25 | In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms (OAuth1 access tokens, application credentials, trusts) could be submitted to the… Affected: 13.0.0 before 27.0.3; 28.0.0 before 28.0.3; 29.0.0 before 29.0.3 |
| CVE-2026-80182 | 7.6 | Aug 25 | In OpenStack Keystone before 29.0.3, tokens obtained via OAuth1 access token, application credential, or trust-scoped authentication could create new long-lived credentials or… Affected: 13.0.0 before 27.0.3; 28.0.0 before 28.0.3; 29.0.0 before 29.0.3 |
| CVE-2021-38155 | 7.5 | Aug 6 | OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclosure during account locking (related to… Affected: 10.0.0 before 16.0.2; 17.0.0 before 17.0.1; 18.0.0 before 18.0.1; 19.0.0 before 19.0.1 |
| CVE-2012-1572 | 7.5 | Nov 12 | OpenStack Keystone: extremely long passwords can crash Keystone by exhausting stack space Affected: All versions, or not specified |
| CVE-2015-7546 | 7.5 | Feb 3 | The identity service in OpenStack Identity (Keystone) before 2015.1.3 (Kilo) and 8.0.x before 8.0.2 (Liberty) and keystonemiddleware (formerly python-keystoneclient) before 1.5.4… Affected: 8.0.0 before 8.0.2; 2015.1.0 through 2015.1.2 |
| CVE-2021-3563 | 7.4 | Aug 26 | A flaw was found in openstack-keystone Affected: All versions, or not specified |
| CVE-2026-80183 | 7.1 | Aug 26 | In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignment under any domain by passing a domain… Affected: 16.0.0 before 27.0.3; 28.0.0 before 28.0.3; 29.0.0 before 29.0.3 |
| CVE-2022-2447 | 6.6 | Sep 1 | A flaw was found in Keystone Affected: All versions, or not specified |
| CVE-2013-0270 | 6.5 | Apr 12 | A flaw was found in OpenStack Keystone Affected: 2012.1 through 2012.1.3; 2012.2 through 2012.2.4; 2013.1; 2013.1; 2013.1 |
| CVE-2013-2255 | 5.9 | Nov 1 | HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side SSL certificates Affected: 2013 |
| CVE-2020-12692 | 5.4 | May 7 | An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0 Affected: before 15.0.1; 16.0.0 |
| CVE-2026-33551 | 5.3 | Apr 10 | An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0 Affected: 14.0.0 before 26.1.1; 27.0.0; 28.0.0; 29.0.0 |
| CVE-2018-20170 | 5.3 | Dec 17 | OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because invalid usernames have much faster responses than valid ones for a POST /v3/auth/tokens request Affected: through 14.0.1 |
| CVE-2018-14432 | 5.3 | Jul 31 | In the Federation component of OpenStack Keystone before 11.0.4, 12.0.0, and 13.0.0, an authenticated "GET /v3/OS-FEDERATION/projects" request may bypass intended access… Affected: before 11.0.4; 12.0.0; 13.0.0 |
| CVE-2015-3646 | – | May 12 | OpenStack Identity (Keystone) before 2014.1.5 and 2014.2.x before 2014.2.4 logs the backend_argument configuration option content, which allows remote authenticated users to… Affected: 2014.1 before 2014.1.5; 2014.2.0 before 2014.2.4 |
| CVE-2014-0204 | – | Nov 3 | OpenStack Identity (Keystone) before 2014.1.1 does not properly handle when a role is assigned to a group that has the same ID as a user, which allows remote authenticated users… Affected: 2014.1 before 2014.1.1 |
| CVE-2014-3520 | – | Oct 26 | OpenStack Identity (Keystone) before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2 allows remote authenticated trustees to gain access to an unauthorized project for… Affected: 2013.2 before 2013.2.4; 2014.1 before 2014.1.2 |
| CVE-2014-3621 | – | Oct 2 | The catalog url replacement in OpenStack Identity (Keystone) before 2013.2.3 and 2014.1 before 2014.1.2.1 allows remote authenticated users to read sensitive configuration options… Affected: 2013.2 before 2013.2.3; 2014.1 before 2014.1.2.1 |
| CVE-2014-5253 | – | Aug 25 | OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 does not properly revoke tokens when a domain is invalidated, which allows remote authenticated… Affected: 2014.1; 2014.1.2; juno-1; juno-2 |
| CVE-2014-5252 | – | Aug 25 | The V3 API in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 updates the issued_at value for UUID v2 tokens, which allows remote authenticated… Affected: 2014.1; 2014.1.2; juno-1; juno-2 |
| CVE-2014-5251 | – | Aug 25 | The MySQL token driver in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 stores timestamps with the incorrect precision, which causes the… Affected: 2014.1; 2014.1.2; juno-1; juno-2 |
| CVE-2014-3476 | – | Jun 17 | OpenStack Identity (Keystone) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 does not properly handle chained delegation, which allows remote authenticated users… Affected: 2013.2 before 2013.2.4; 2014.1 before 2014.1.2 |
| CVE-2013-2014 | – | Jun 2 | OpenStack Identity (Keystone) before 2013.1 allows remote attackers to cause a denial of service (memory consumption and crash) via multiple long requests Affected: 2013 before 2013.1 |
| CVE-2014-2828 | – | Apr 15 | The V3 API in OpenStack Identity (Keystone) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 allows remote attackers to cause a denial of service (CPU consumption) via a… Affected: 2013.1; 2013.1.1; 2013.1.2; 2013.1.3; 2013.2; 2013.2.1; +2 more |
| CVE-2014-2237 | – | Apr 1 | The memcache token backend in OpenStack Identity (Keystone) 2013.1 through 2.013.1.4, 2013.2 through 2013.2.2, and icehouse before icehouse-3, when issuing a trust token with… Affected: 2013.1; 2013.1.1; 2013.1.2; 2013.1.3; 2013.1.4; 2013.2.2 |
| CVE-2013-6391 | – | Dec 14 | The ec2tokens API in OpenStack Identity (Keystone) before Havana 2013.2.1 and Icehouse before icehouse-2 does not return a trust-scoped token when one is received, which allows… Affected: 2013.2 before 2013.2.1 |
| CVE-2013-4222 | – | Sep 30 | OpenStack Identity (Keystone) Folsom, Grizzly 2013.1.3 and earlier, and Havana before havana-3 does not properly revoke user tokens when a tenant is disabled, which allows remote… Affected: 2013.1 through 2013.1.3 |
| CVE-2013-4294 | – | Sep 23 | The (1) mamcache and (2) KVS token backends in OpenStack Identity (Keystone) Folsom 2012.2.x and Grizzly before 2013.1.4 do not properly compare the PKI token revocation list with… Affected: 2012.2; 2012.2.1; 2012.2.2; 2012.2.3; 2012.2.4; 2013.1; +3 more |
| CVE-2013-2157 | – | Aug 20 | OpenStack Keystone Folsom, Grizzly before 2013.1.3, and Havana, when using LDAP with Anonymous binding, allows remote attackers to bypass authentication via an empty password Affected: 2012.2 through 2012.2.4; 2013.1 before 2013.1.3; 2013.2 through 2013.2.4 |
| CVE-2013-2059 | – | May 21 | OpenStack Identity (Keystone) Folsom 2012.2.4 and earlier, Grizzly before 2013.1.1, and Havana does not immediately revoke the authentication token when deleting a user through… Affected: 2012.1; 2013.1 |
| CVE-2013-2006 | – | May 21 | OpenStack Identity (Keystone) Grizzly 2013.1.1, when DEBUG mode logging is enabled, logs the (1) admin_token and (2) LDAP password in plaintext, which allows local users to obtain… Affected: 2013.1.1 |
| CVE-2013-0282 | – | Apr 12 | OpenStack Keystone Grizzly before 2013.1, Folsom 2012.1.3 and earlier, and Essex does not properly check if the (1) user, (2) tenant, or (3) domain is enabled when using EC2-style… Affected: 2012.1 through 2012.1.3; 2012.2 through 2012.2.4; 2013.1; 2013.1; 2013.1 |
| CVE-2013-0247 | – | Feb 24 | OpenStack Keystone Essex 2012.1.3 and earlier, Folsom 2012.2.3 and earlier, and Grizzly grizzly-2 and earlier allows remote attackers to cause a denial of service (disk… Affected: 2012.1 through 2012.1.3; 2012.2 through 2012.2.3; 2013.1 through 2013.1.2 |
| CVE-2012-5483 | – | Dec 26 | tools/sample_data.sh in OpenStack Keystone 2012.1.3, when access to Amazon Elastic Compute Cloud (Amazon EC2) is configured, uses world-readable permissions for… Affected: 2012.1.3 |
| CVE-2012-4457 | – | Oct 9 | OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-3 does not properly handle authorization tokens for disabled tenants, which allows remote authenticated users to… Affected: 2012.1 before 2012.1.2; 2012.2; 2012.2 |
| CVE-2012-4456 | – | Oct 9 | The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote… Affected: 2012.1 before 2012.1.2; 2012.2 |
| CVE-2012-4413 | – | Sep 18 | OpenStack Keystone 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to retain the privileges of the revoked… Affected: 2012.1.3 |
| CVE-2012-3426 | – | Jul 31 | OpenStack Keystone before 2012.1.1, as used in OpenStack Folsom before Folsom-1 and OpenStack Essex, does not properly implement token expiration, which allows remote… Affected: 2012.1; 2012.1.1 |
Showing 49