# keystone (PyPI) vulnerabilities 44 known vulnerabilities (3 high, 7 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Weekly downloads: 13.2K - Dependents: 4 - Registry: https://pypi.org/project/keystone/ ## Advisories (44) ### [CVE-2026-44394](https://cve.now/CVE-2026-44394): An issue was discovered in OpenStack Keystone before 29.0.2. - Severity: Medium 6.0 - Published: May 28, 2026 - Affected: from 14.0.0, fixed in 27.0.2; from 28.0.0, fixed in 28.0.2; from 29.0.0, fixed in 29.0.2; from 14.0.0, fixed in 27.0.2; from 28.0.0, fixed in 28.0.2; from 29.0.0, fixed in 29.0.2. ### [CVE-2026-43000](https://cve.now/CVE-2026-43000): An issue was discovered in OpenStack Keystone before 29.0.2. - Severity: Medium 6.0 - Published: May 28, 2026 - Affected: from 14.0.0, fixed in 27.0.2; from 28.0.0, fixed in 28.0.2; from 29.0.0, fixed in 29.0.2; from 14.0.0, fixed in 27.0.2; from 28.0.0, fixed in 28.0.2; from 29.0.0, fixed in 29.0.2. ### [CVE-2026-42999](https://cve.now/CVE-2026-42999): An issue was discovered in OpenStack Keystone before 29.0.2. - Severity: Medium 6.0 - Published: May 28, 2026 - Affected: from 14.0.0, fixed in 27.0.2; from 28.0.0, fixed in 28.0.2; from 29.0.0, fixed in 29.0.2; from 14.0.0, fixed in 27.0.2; from 28.0.0, fixed in 28.0.2; from 29.0.0, fixed in 29.0.2. ### [CVE-2026-42998](https://cve.now/CVE-2026-42998): An issue was discovered in OpenStack Keystone before 29.0.2. - Severity: Medium 6.0 - Published: May 28, 2026 - Affected: from 14.0.0, fixed in 27.0.2; from 28.0.0, fixed in 28.0.2; from 29.0.0, fixed in 29.0.2; from 14.0.0, fixed in 27.0.2; from 28.0.0, fixed in 28.0.2; from 29.0.0, fixed in 29.0.2. ### [CVE-2026-43001](https://cve.now/CVE-2026-43001): An issue was discovered in OpenStack Keystone before 29.0.2. - Severity: High 7.9 - Published: May 1, 2026 - Affected: from 13.0.0, through 29.0.1; from 14.0.0, fixed in 27.0.2; from 28.0.0, fixed in 28.0.2; from 29.0.0, fixed in 29.0.2. ### [CVE-2026-40683](https://cve.now/CVE-2026-40683): In OpenStack Keystone before 28.0.1, the LDAP identity backend does not convert the user enabled attribute to a boolean when the… - Severity: High 7.7 - Published: Apr 14, 2026 - Affected: fixed in 28.0.1; fixed in 28.0.1. ### [CVE-2026-33551](https://cve.now/CVE-2026-33551): An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0. - Severity: Low 3.5 - Published: Apr 10, 2026 - Affected: from 14.0.0, fixed in 26.1.1. ### [CVE-2025-65073](https://cve.now/CVE-2025-65073): OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Signature to provide… - Severity: High 7.5 - Published: Nov 17, 2025 - Affected: fixed in 26.0.1; from 27.0.0.0rc1, fixed in 27.0.0; from 28.0.0.0rc1, fixed in 28.0.0; fixed in 26.0.1; from 27.0.0.0rc1, fixed in 27.0.0; from 28.0.0.0rc1, fixed in 28.0.0. ### [CVE-2021-3563](https://cve.now/CVE-2021-3563): A flaw was found in openstack-keystone. - Severity: Unrated - Published: Aug 26, 2022 - Affected: through 21.0.0. ### [CVE-2021-38155](https://cve.now/CVE-2021-38155): OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information… - Severity: Unrated - Published: Aug 6, 2021 - Affected: from 10.0, fixed in 16.0.2; from 17.0, fixed in 17.0.1; from 18.0, fixed in 18.0.1; from 19.0, fixed in 19.0.1; from 10.0, fixed in 16.0.2; from 17.0, fixed in 17.0.1; from 18.0, fixed in 18.0.1; from 19.0, fixed in 19.0.1. ### [CVE-2020-12689](https://cve.now/CVE-2020-12689): An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. - Severity: Unrated - Published: May 6, 2020 - Affected: fixed in 15.0.1; from 16.0.0, fixed in 16.0.1. ### [CVE-2020-12690](https://cve.now/CVE-2020-12690): An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. - Severity: Unrated - Published: May 6, 2020 - Affected: fixed in 15.0.1; fixed in 15.0.1; from 16.0.0.0rc1, fixed in 16.0.0. ### [CVE-2020-12691](https://cve.now/CVE-2020-12691): An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. - Severity: Unrated - Published: May 6, 2020 - Affected: fixed in 15.0.1; from 16.0.0, fixed in 16.0.1. ### [CVE-2020-12692](https://cve.now/CVE-2020-12692): An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. - Severity: Unrated - Published: May 6, 2020 - Affected: from 16.0.0.0rc1, fixed in 16.0.0; fixed in 15.0.1. ### [CVE-2019-19687](https://cve.now/CVE-2019-19687): OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. - Severity: Unrated - Published: Dec 9, 2019 - Affected: fixed in 16.0.1; from 15.0.0, fixed in 15.0.1; from 16.0.0, fixed in 16.0.1. ### [CVE-2013-2255](https://cve.now/CVE-2013-2255): HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate… - Severity: Unrated - Published: Nov 1, 2019 - Affected: fixed in 8.0.0a0. ### [CVE-2018-20170](https://cve.now/CVE-2018-20170): OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because invalid usernames have much faster responses than valid… - Severity: Unrated - Published: Dec 17, 2018 - Affected: fixed in 14.1.0. ### [CVE-2017-2673](https://cve.now/CVE-2017-2673): An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service (keystone). - Severity: Medium 6.8 - Published: Jul 19, 2018 - Affected: from 9.0.0, through 9.3.0; from 10.0.0, fixed in 10.0.2; from 11.0.0, fixed in 11.0.1; from 9.0.0, fixed in 10.0.2; from 11.0.0, fixed in 11.0.1. ### [CVE-2016-4911](https://cve.now/CVE-2016-4911): The Fernet Token Provider in OpenStack Identity (Keystone) 9.0.x before 9.0.1 (mitaka) allows remote authenticated users to prevent… - Severity: Unrated - Published: Jun 13, 2016 - Affected: from 9.0.0, fixed in 9.0.1. ### [CVE-2015-7546](https://cve.now/CVE-2015-7546): The identity service in OpenStack Identity (Keystone) before 2015.1.3 (Kilo) and 8.0.x before 8.0.2 (Liberty) and keystonemiddleware… - Severity: Unrated - Published: Feb 3, 2016 - Affected: from 8.0, fixed in 8.1.0; from 9.0.0.0b1, fixed in 9.0.0.0b2; from 9.0.0.0b1, fixed in 9.0.0.0b2; from 8.0, fixed in 8.1.0. ### [CVE-2015-3646](https://cve.now/CVE-2015-3646): OpenStack Identity (Keystone) before 2014.1.5 and 2014.2.x before 2014.2.4 logs the backend\_argument configuration option content, which… - Severity: Unrated - Published: May 12, 2015 - Affected: from 2011.3, fixed in 2014.1.5; from 2014.2, fixed in 2014.2.4; from 2011.3, fixed in 2014.1.5; from 2014.2, fixed in 2014.2.4. ### [CVE-2014-0204](https://cve.now/CVE-2014-0204): OpenStack Identity (Keystone) before 2014.1.1 does not properly handle when a role is assigned to a group that has the same ID as a user… - Severity: Unrated - Published: Nov 3, 2014 - Affected: fixed in 8.0.0a0. ### [CVE-2014-3621](https://cve.now/CVE-2014-3621): The catalog url replacement in OpenStack Identity (Keystone) before 2013.2.3 and 2014.1 before 2014.1.2.1 allows remote authenticated… - Severity: Unrated - Published: Oct 2, 2014 - Affected: fixed in 8.0.0a0. ### [CVE-2014-5253](https://cve.now/CVE-2014-5253): OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 does not properly revoke tokens when a domain is… - Severity: Unrated - Published: Aug 25, 2014 - Affected: fixed in 8.0.0a0. ### [CVE-2014-5252](https://cve.now/CVE-2014-5252): The V3 API in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 updates the issued\_at value for UUID v2… - Severity: Unrated - Published: Aug 25, 2014 - Affected: fixed in 8.0.0a0. ### [CVE-2014-5251](https://cve.now/CVE-2014-5251): The MySQL token driver in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 stores timestamps with the… - Severity: Unrated - Published: Aug 25, 2014 - Affected: fixed in 8.0.0a0. ### [CVE-2014-3476](https://cve.now/CVE-2014-3476): OpenStack Identity (Keystone) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 does not properly handle chained delegation… - Severity: Unrated - Published: Jun 17, 2014 - Affected: fixed in 8.0.0a0. ### [CVE-2013-2014](https://cve.now/CVE-2013-2014): OpenStack Identity (Keystone) before 2013.1 allows remote attackers to cause a denial of service (memory consumption and crash) via… - Severity: Unrated - Published: Jun 2, 2014 - Affected: fixed in 8.0.0a0. ### [CVE-2014-2828](https://cve.now/CVE-2014-2828): The V3 API in OpenStack Identity (Keystone) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 allows remote attackers to cause a… - Severity: Unrated - Published: Apr 15, 2014 - Affected: fixed in 8.0.0a0. ### [CVE-2014-2237](https://cve.now/CVE-2014-2237): The memcache token backend in OpenStack Identity (Keystone) 2013.1 through 2.013.1.4, 2013.2 through 2013.2.2, and icehouse before… - Severity: Unrated - Published: Apr 1, 2014 - Affected: fixed in 8.0.0a0. ### [CVE-2013-4477](https://cve.now/CVE-2013-4477): The LDAP backend in OpenStack Identity (Keystone) Grizzly and Havana, when removing a role on a tenant for a user who does not have that… - Severity: Unrated - Published: Nov 2, 2013 - Affected: fixed in 8.0.0a0. ### [CVE-2013-4294](https://cve.now/CVE-2013-4294): The (1) mamcache and (2) KVS token backends in OpenStack Identity (Keystone) Folsom 2012.2.x and Grizzly before 2013.1.4 do not properly… - Severity: Unrated - Published: Sep 23, 2013 - Affected: from 2012.2.0, fixed in 2013.1.4. ### [CVE-2013-2059](https://cve.now/CVE-2013-2059): OpenStack Identity (Keystone) Folsom 2012.2.4 and earlier, Grizzly before 2013.1.1, and Havana does not immediately revoke the… - Severity: Unrated - Published: May 21, 2013 - Affected: fixed in 8.0.0a0. ### [CVE-2013-2006](https://cve.now/CVE-2013-2006): OpenStack Identity (Keystone) Grizzly 2013.1.1, when DEBUG mode logging is enabled, logs the (1) admin\_token and (2) LDAP password in… - Severity: Unrated - Published: May 21, 2013 - Affected: fixed in 8.0.0a0. ### [CVE-2013-0282](https://cve.now/CVE-2013-0282): OpenStack Keystone Grizzly before 2013.1, Folsom 2012.1.3 and earlier, and Essex does not properly check if the (1) user, (2) tenant, or… - Severity: Unrated - Published: Apr 12, 2013 - Affected: fixed in 8.0.0a0. ### [CVE-2013-0270](https://cve.now/CVE-2013-0270): Keystone: openstack keystone: denial of service via large http request with long tenant name - Severity: Medium 6.5 - Published: Apr 12, 2013 - Affected: fixed in 8.0.0a0. ### [CVE-2013-1865](https://cve.now/CVE-2013-1865): OpenStack Keystone Folsom (2012.2) does not properly perform revocation checks for Keystone PKI tokens when done through a server, which… - Severity: Unrated - Published: Mar 22, 2013 - Affected: from 2012.2, fixed in 2012.2.4. ### [CVE-2012-5571](https://cve.now/CVE-2012-5571): Openstack keystone: openstack keystone: authorization bypass via improper ec2 token handling - Severity: Medium 5.4 - Published: Dec 18, 2012 - Affected: fixed in 8.0.0a0. ### [CVE-2012-5563](https://cve.now/CVE-2012-5563): OpenStack Keystone, as used in OpenStack Folsom 2012.2, does not properly implement token expiration, which allows remote authenticated… - Severity: Unrated - Published: Dec 18, 2012 - Affected: all versions; fixed in 8.0.0. ### [CVE-2012-4457](https://cve.now/CVE-2012-4457): OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-3 does not properly handle authorization tokens for disabled tenants… - Severity: Unrated - Published: Oct 9, 2012 - Affected: fixed in 8.0.0a0. ### [CVE-2012-4456](https://cve.now/CVE-2012-4456): The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly… - Severity: Unrated - Published: Oct 9, 2012 - Affected: from 2012.1, fixed in 2012.1.2. ### [CVE-2012-4413](https://cve.now/CVE-2012-4413): OpenStack Keystone 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users… - Severity: Unrated - Published: Sep 18, 2012 - Affected: fixed in 2012.1.3; fixed in 2012.1.3. ### [CVE-2012-3542](https://cve.now/CVE-2012-3542): OpenStack Keystone, as used in OpenStack Folsom before folsom-rc1 and OpenStack Essex (2012.1), allows remote attackers to add an… - Severity: Unrated - Published: Sep 5, 2012 - Affected: all versions; fixed in 2012.1. ### [CVE-2012-3426](https://cve.now/CVE-2012-3426): OpenStack Keystone before 2012.1.1, as used in OpenStack Folsom before Folsom-1 and OpenStack Essex, does not properly implement token… - Severity: Unrated - Published: Jul 31, 2012 - Affected: fixed in 8.0.0a0. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/keystone Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.