Login Request a demo
KE
Product
Keystone
by OpenStack · last CVE Sep 11, 2026
49
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Vulnerabilities49In the news0Timeline
Severity mix
Critical 0High 18Medium 7Low 0
Severity
All severities49Critical0High18Medium7Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Keystone to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-43000
8.8
0%
May 28
An issue was discovered in OpenStack Keystone before 29.0.2
Affected: 14.0.0 before 27.0.2; 28.0.0 before 28.0.2; 29.0.0 before 29.0.2
CVE-2026-42998
8.8
0%
May 28
An issue was discovered in OpenStack Keystone before 29.0.2
Affected: 14.0.0 before 27.0.2; 28.0.0 before 28.0.2; 29.0.0 before 29.0.2
CVE-2026-42999
8.8
0%
May 28
An issue was discovered in OpenStack Keystone before 29.0.2
Affected: 14.0.0 before 27.0.2; 28.0.0 before 28.0.2; 29.0.0 before 29.0.2
CVE-2020-12691
8.8
5%
May 7
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0
Affected: before 15.0.1; 16.0.0
CVE-2020-12690
8.8
2%
May 7
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0
Affected: before 15.0.1; 16.0.0
CVE-2020-12689
8.8
2%
May 7
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0
Affected: before 15.0.1; 16.0.0
CVE-2019-19687
8.8
2%
Dec 9
OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API
Affected: 15.0.0; 16.0.0
CVE-2026-44394
8.1
0%
May 28
An issue was discovered in OpenStack Keystone before 29.0.2
Affected: 14.0.0 before 27.0.2; 28.0.0 before 28.0.2; 29.0.0 before 29.0.2
CVE-2026-43001
8.0
0%
May 1
An issue was discovered in OpenStack Keystone before 29.0.2
Affected: 14.0.0 before 27.0.2; 28.0.0 before 28.0.2; 29.0.0 before 29.0.2
CVE-2026-40683
7.7
0%
Apr 14
In OpenStack Keystone before 28.0.1, the LDAP identity backend does not convert the user enabled attribute to a boolean when the user_enabled_invert configuration option is False…
Affected: 8.0.0 before 25.0.1; 26.0.0 before 26.1.1; 27.0.0 before 27.0.1; 28.0.0 before 28.0.1
CVE-2026-90460
7.6
1%
Sep 11
An issue was discovered in OpenStack Keystone before 29.0.3
Affected: 13.0.0 before 27.0.3; 28.0.0 before 28.0.3; 29.0.0 before 29.0.3
CVE-2026-80184
7.6
1%
Aug 25
In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms (OAuth1 access tokens, application credentials, trusts) could be submitted to the…
Affected: 13.0.0 before 27.0.3; 28.0.0 before 28.0.3; 29.0.0 before 29.0.3
CVE-2026-80182
7.6
1%
Aug 25
In OpenStack Keystone before 29.0.3, tokens obtained via OAuth1 access token, application credential, or trust-scoped authentication could create new long-lived credentials or…
Affected: 13.0.0 before 27.0.3; 28.0.0 before 28.0.3; 29.0.0 before 29.0.3
CVE-2021-38155
7.5
2%
Aug 6
OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclosure during account locking (related to…
Affected: 10.0.0 before 16.0.2; 17.0.0 before 17.0.1; 18.0.0 before 18.0.1; 19.0.0 before 19.0.1
CVE-2012-1572
7.5
1%
Nov 12
OpenStack Keystone: extremely long passwords can crash Keystone by exhausting stack space
Affected: All versions, or not specified
CVE-2015-7546
7.5
2%
Feb 3
The identity service in OpenStack Identity (Keystone) before 2015.1.3 (Kilo) and 8.0.x before 8.0.2 (Liberty) and keystonemiddleware (formerly python-keystoneclient) before 1.5.4…
Affected: 8.0.0 before 8.0.2; 2015.1.0 through 2015.1.2
CVE-2021-3563
7.4
2%
Aug 26
A flaw was found in openstack-keystone
Affected: All versions, or not specified
CVE-2026-80183
7.1
0%
Aug 26
In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignment under any domain by passing a domain…
Affected: 16.0.0 before 27.0.3; 28.0.0 before 28.0.3; 29.0.0 before 29.0.3
Showing 18