OpenStack Nova uses insecure keystone middleware tmpdir by default

keystone/middleware/authtoken.py in OpenStack Nova Folsom, Grizzly, and Havana uses an insecure temporary directory for storing signing certificates, which allows local users to spoof servers by pre-creating this directory, which is reused by Nova, as demonstrated using /tmp/keystone-signing-nova...

PYSEC-2026-911 OpenStack Nova uses insecure keystone middleware tmpdir by default

keystone/middleware/authtoken.py in OpenStack Nova Folsom, Grizzly, and Havana uses an insecure temporary directory for storing signing certificates, which allows local users to spoof servers by pre-creating this directory, which is reused by Nova, as demonstrated using /tmp/keystone-signing-nova...

a10-octavia (>=2.0.0.0b1, <=2.2.0) potentially affected by CVE-2012-4413 via keystone (18.0.0)

keystone PYPI version 18.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on keystone and may be impacted: - a10-octavia =2.0.0.0b1, =2.2.0 Source cves: CVE-2012-4413 Source advisory: OSV:PYSEC-2026-833...

a10-octavia (>=1.0.0.0a1, <=1.3.3) potentially affected by CVE-2012-4413 via keystone (15.0.1)

keystone PYPI version 15.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on keystone and may be impacted: - a10-octavia =1.0.0.0a1, =1.3.3 Source cves: CVE-2012-4413 Source advisory: OSV:PYSEC-2026-833...

OpenStack Keystone does not invalidate existing tokens when granting or revoking roles

OpenStack Keystone before 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to retain the privileges of the revoked roles...

PYSEC-2026-833 OpenStack Keystone does not invalidate existing tokens when granting or revoking roles

OpenStack Keystone before 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to retain the privileges of the revoked roles...

OpenStack Keystone Token authorization for a user in a disabled tenant is allowed

OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-3 does not properly handle authorization tokens for disabled tenants, which allows remote authenticated users to access the tenant's resources by requesting a token for the tenant...

PYSEC-2026-832 OpenStack Keystone Improper Authentication vulnerability

The 1 OS-KSADM/services and 2 tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary user or get, create, or delete arbitrary services...

OpenStack Keystone Improper Authentication vulnerability

The 1 OS-KSADM/services and 2 tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary user or get, create, or delete arbitrary services...

GHSA-2R23-2G6V-2M5F vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.2, openstack-keystone-2026.1-fips, openstack-keystone-2025.1, openstack-keystone-2025.1-fips, openstack-keystone-2025.2-fips, openstack-keystone-2026.1...

CVE-2026-42998 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.2, openstack-keystone-2026.1-fips, openstack-keystone-2025.1, openstack-keystone-2025.1-fips, openstack-keystone-2025.2-fips, openstack-keystone-2026.1...

CVE-2026-43000 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.2, openstack-keystone-2026.1-fips, openstack-keystone-2025.1, openstack-keystone-2025.1-fips, openstack-keystone-2025.2-fips, openstack-keystone-2026.1...

GHSA-8F8M-WRVR-WCVF vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.2, openstack-keystone-2026.1-fips, openstack-keystone-2025.1, openstack-keystone-2025.1-fips, openstack-keystone-2025.2-fips, openstack-keystone-2026.1...

GHSA-Q623-F4J4-P4XJ vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.2, openstack-keystone-2026.1-fips, openstack-keystone-2025.1, openstack-keystone-2025.1-fips, openstack-keystone-2025.2-fips, openstack-keystone-2026.1...

GHSA-WHQR-FGM5-X77Q vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.2, openstack-keystone-2026.1-fips, openstack-keystone-2025.1, openstack-keystone-2025.1-fips, openstack-keystone-2025.2-fips, openstack-keystone-2026.1...

CVE-2026-42999 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.2, openstack-keystone-2026.1-fips, openstack-keystone-2025.1, openstack-keystone-2025.1-fips, openstack-keystone-2025.2-fips, openstack-keystone-2026.1...

CVE-2026-44394 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.2, openstack-keystone-2026.1-fips, openstack-keystone-2025.1, openstack-keystone-2025.1-fips, openstack-keystone-2025.2-fips, openstack-keystone-2026.1...

PYSEC-2026-619 Openstack Aodh can be used to launder Keystone trusts

Aodh as packaged in Openstack Ocata and Newton before change-ID I8fd11a7f9fe3c0ea5f9843a89686ac06713b7851 and before Pike-rc1 does not verify that trust IDs belong to the user when creating alarm action with the scheme trust+http, which allows remote authenticated users with knowledge of trust ID...

Openstack Aodh can be used to launder Keystone trusts

Aodh as packaged in Openstack Ocata and Newton before change-ID I8fd11a7f9fe3c0ea5f9843a89686ac06713b7851 and before Pike-rc1 does not verify that trust IDs belong to the user when creating alarm action with the scheme trust+http, which allows remote authenticated users with knowledge of trust ID...

OpenStack Identity Keystone is vulnerable to Block delegation escalation of privilege

OpenStack Identity Keystone before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 does not properly handle chained delegation, which allows remote authenticated users to gain privileges by leveraging a 1 trust or 2 OAuth token with impersonation enabled to create a new token with...