Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

keystone

44 known vulnerabilities (3 high, 7 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
44 · 3 high, 7 medium, 1 low
Weekly downloads
13.2K
Dependents
4
Registry
PyPI

Advisories 44

  • CVE-2026-44394Medium 6.0

    An issue was discovered in OpenStack Keystone before 29.0.2.

    Affected: from 14.0.0, fixed in 27.0.2; from 28.0.0, fixed in 28.0.2; from 29.0.0, fixed in 29.0.2; from 14.0.0, fixed in 27.0.2; from 28.0.0, fixed in 28.0.2; from 29.0.0, fixed in 29.0.2.

  • CVE-2026-43000Medium 6.0

    An issue was discovered in OpenStack Keystone before 29.0.2.

    Affected: from 14.0.0, fixed in 27.0.2; from 28.0.0, fixed in 28.0.2; from 29.0.0, fixed in 29.0.2; from 14.0.0, fixed in 27.0.2; from 28.0.0, fixed in 28.0.2; from 29.0.0, fixed in 29.0.2.

  • CVE-2026-42999Medium 6.0

    An issue was discovered in OpenStack Keystone before 29.0.2.

    Affected: from 14.0.0, fixed in 27.0.2; from 28.0.0, fixed in 28.0.2; from 29.0.0, fixed in 29.0.2; from 14.0.0, fixed in 27.0.2; from 28.0.0, fixed in 28.0.2; from 29.0.0, fixed in 29.0.2.

  • CVE-2026-42998Medium 6.0

    An issue was discovered in OpenStack Keystone before 29.0.2.

    Affected: from 14.0.0, fixed in 27.0.2; from 28.0.0, fixed in 28.0.2; from 29.0.0, fixed in 29.0.2; from 14.0.0, fixed in 27.0.2; from 28.0.0, fixed in 28.0.2; from 29.0.0, fixed in 29.0.2.

  • An issue was discovered in OpenStack Keystone before 29.0.2.

    Affected: from 13.0.0, through 29.0.1; from 14.0.0, fixed in 27.0.2; from 28.0.0, fixed in 28.0.2; from 29.0.0, fixed in 29.0.2.

  • In OpenStack Keystone before 28.0.1, the LDAP identity backend does not convert the user enabled attribute to a boolean when the…

    Affected: fixed in 28.0.1; fixed in 28.0.1.

  • An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0.

    Affected: from 14.0.0, fixed in 26.1.1.

  • OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Signature to provide…

    Affected: fixed in 26.0.1; from 27.0.0.0rc1, fixed in 27.0.0; from 28.0.0.0rc1, fixed in 28.0.0; fixed in 26.0.1; from 27.0.0.0rc1, fixed in 27.0.0; from 28.0.0.0rc1, fixed in 28.0.0.

  • A flaw was found in openstack-keystone.

    Affected: through 21.0.0.

  • OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information…

    Affected: from 10.0, fixed in 16.0.2; from 17.0, fixed in 17.0.1; from 18.0, fixed in 18.0.1; from 19.0, fixed in 19.0.1; from 10.0, fixed in 16.0.2; from 17.0, fixed in 17.0.1; from 18.0, fixed in 18.0.1; from 19.0, fixed in 19.0.1.

  • An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0.

    Affected: fixed in 15.0.1; from 16.0.0, fixed in 16.0.1.

  • An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0.

    Affected: fixed in 15.0.1; fixed in 15.0.1; from 16.0.0.0rc1, fixed in 16.0.0.

  • An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0.

    Affected: fixed in 15.0.1; from 16.0.0, fixed in 16.0.1.

  • An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0.

    Affected: from 16.0.0.0rc1, fixed in 16.0.0; fixed in 15.0.1.

  • OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API.

    Affected: fixed in 16.0.1; from 15.0.0, fixed in 15.0.1; from 16.0.0, fixed in 16.0.1.

Show all 44 advisoriesShow fewer advisories

  • HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate…

    Affected: fixed in 8.0.0a0.

  • OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because invalid usernames have much faster responses than valid…

    Affected: fixed in 14.1.0.

  • CVE-2017-2673Medium 6.8

    An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service (keystone).

    Affected: from 9.0.0, through 9.3.0; from 10.0.0, fixed in 10.0.2; from 11.0.0, fixed in 11.0.1; from 9.0.0, fixed in 10.0.2; from 11.0.0, fixed in 11.0.1.

  • The Fernet Token Provider in OpenStack Identity (Keystone) 9.0.x before 9.0.1 (mitaka) allows remote authenticated users to prevent…

    Affected: from 9.0.0, fixed in 9.0.1.

  • The identity service in OpenStack Identity (Keystone) before 2015.1.3 (Kilo) and 8.0.x before 8.0.2 (Liberty) and keystonemiddleware…

    Affected: from 8.0, fixed in 8.1.0; from 9.0.0.0b1, fixed in 9.0.0.0b2; from 9.0.0.0b1, fixed in 9.0.0.0b2; from 8.0, fixed in 8.1.0.

  • OpenStack Identity (Keystone) before 2014.1.5 and 2014.2.x before 2014.2.4 logs the backend_argument configuration option content, which…

    Affected: from 2011.3, fixed in 2014.1.5; from 2014.2, fixed in 2014.2.4; from 2011.3, fixed in 2014.1.5; from 2014.2, fixed in 2014.2.4.

  • OpenStack Identity (Keystone) before 2014.1.1 does not properly handle when a role is assigned to a group that has the same ID as a user…

    Affected: fixed in 8.0.0a0.

  • The catalog url replacement in OpenStack Identity (Keystone) before 2013.2.3 and 2014.1 before 2014.1.2.1 allows remote authenticated…

    Affected: fixed in 8.0.0a0.

  • OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 does not properly revoke tokens when a domain is…

    Affected: fixed in 8.0.0a0.

  • The V3 API in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 updates the issued_at value for UUID v2…

    Affected: fixed in 8.0.0a0.

  • The MySQL token driver in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 stores timestamps with the…

    Affected: fixed in 8.0.0a0.

  • OpenStack Identity (Keystone) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 does not properly handle chained delegation…

    Affected: fixed in 8.0.0a0.

  • OpenStack Identity (Keystone) before 2013.1 allows remote attackers to cause a denial of service (memory consumption and crash) via…

    Affected: fixed in 8.0.0a0.

  • The V3 API in OpenStack Identity (Keystone) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 allows remote attackers to cause a…

    Affected: fixed in 8.0.0a0.

  • The memcache token backend in OpenStack Identity (Keystone) 2013.1 through 2.013.1.4, 2013.2 through 2013.2.2, and icehouse before…

    Affected: fixed in 8.0.0a0.

  • The LDAP backend in OpenStack Identity (Keystone) Grizzly and Havana, when removing a role on a tenant for a user who does not have that…

    Affected: fixed in 8.0.0a0.

  • The (1) mamcache and (2) KVS token backends in OpenStack Identity (Keystone) Folsom 2012.2.x and Grizzly before 2013.1.4 do not properly…

    Affected: from 2012.2.0, fixed in 2013.1.4.

  • OpenStack Identity (Keystone) Folsom 2012.2.4 and earlier, Grizzly before 2013.1.1, and Havana does not immediately revoke the…

    Affected: fixed in 8.0.0a0.

  • OpenStack Identity (Keystone) Grizzly 2013.1.1, when DEBUG mode logging is enabled, logs the (1) admin_token and (2) LDAP password in…

    Affected: fixed in 8.0.0a0.

  • OpenStack Keystone Grizzly before 2013.1, Folsom 2012.1.3 and earlier, and Essex does not properly check if the (1) user, (2) tenant, or…

    Affected: fixed in 8.0.0a0.

  • CVE-2013-0270Medium 6.5

    Keystone: openstack keystone: denial of service via large http request with long tenant name

    Affected: fixed in 8.0.0a0.

  • OpenStack Keystone Folsom (2012.2) does not properly perform revocation checks for Keystone PKI tokens when done through a server, which…

    Affected: from 2012.2, fixed in 2012.2.4.

  • CVE-2012-5571Medium 5.4

    Openstack keystone: openstack keystone: authorization bypass via improper ec2 token handling

    Affected: fixed in 8.0.0a0.

  • OpenStack Keystone, as used in OpenStack Folsom 2012.2, does not properly implement token expiration, which allows remote authenticated…

    Affected: all versions; fixed in 8.0.0.

  • OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-3 does not properly handle authorization tokens for disabled tenants…

    Affected: fixed in 8.0.0a0.

  • The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly…

    Affected: from 2012.1, fixed in 2012.1.2.

  • OpenStack Keystone 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users…

    Affected: fixed in 2012.1.3; fixed in 2012.1.3.

  • OpenStack Keystone, as used in OpenStack Folsom before folsom-rc1 and OpenStack Essex (2012.1), allows remote attackers to add an…

    Affected: all versions; fixed in 2012.1.

  • OpenStack Keystone before 2012.1.1, as used in OpenStack Folsom before Folsom-1 and OpenStack Essex, does not properly implement token…

    Affected: fixed in 8.0.0a0.