PYSEC-2026-802 XML External Entity (XXE) in Django

The XML libraries for Python as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity XXE attack...

PYSEC-2026-911 OpenStack Nova uses insecure keystone middleware tmpdir by default

keystone/middleware/authtoken.py in OpenStack Nova Folsom, Grizzly, and Havana uses an insecure temporary directory for storing signing certificates, which allows local users to spoof servers by pre-creating this directory, which is reused by Nova, as demonstrated using /tmp/keystone-signing-nova...

PYSEC-2026-831 OpenStack Identity Keystone Privilege Escalation vulnerability

The LDAP backend in OpenStack Identity Keystone Grizzly and Havana, when removing a role on a tenant for a user who does not have that role, adds the role to the user, which allows local users to gain privileges...

OpenStack Keystone does not invalidate existing tokens when granting or revoking roles

OpenStack Keystone before 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to retain the privileges of the revoked roles...

PYSEC-2026-833 OpenStack Keystone does not invalidate existing tokens when granting or revoking roles

OpenStack Keystone before 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to retain the privileges of the revoked roles...

OpenStack Keystone Token authorization for a user in a disabled tenant is allowed

OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-3 does not properly handle authorization tokens for disabled tenants, which allows remote authenticated users to access the tenant's resources by requesting a token for the tenant...

CVE-2026-44394 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.2-fips, openstack-keystone-2025.2, openstack-keystone-2025.1-fips, openstack-keystone-2026.1-fips, openstack-keystone-2025.1, openstack-keystone-2026.1...

GHSA-Q623-F4J4-P4XJ vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.2-fips, openstack-keystone-2025.2, openstack-keystone-2025.1-fips, openstack-keystone-2026.1-fips, openstack-keystone-2025.1, openstack-keystone-2026.1...

GHSA-8F8M-WRVR-WCVF vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.2-fips, openstack-keystone-2025.2, openstack-keystone-2025.1-fips, openstack-keystone-2026.1-fips, openstack-keystone-2025.1, openstack-keystone-2026.1...

CVE-2026-42999 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.2-fips, openstack-keystone-2025.2, openstack-keystone-2025.1-fips, openstack-keystone-2026.1-fips, openstack-keystone-2025.1, openstack-keystone-2026.1...

GHSA-2R23-2G6V-2M5F vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.2-fips, openstack-keystone-2025.2, openstack-keystone-2025.1-fips, openstack-keystone-2026.1-fips, openstack-keystone-2025.1, openstack-keystone-2026.1...

CVE-2026-42998 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.2-fips, openstack-keystone-2025.2, openstack-keystone-2025.1-fips, openstack-keystone-2026.1-fips, openstack-keystone-2025.1, openstack-keystone-2026.1...

GHSA-WHQR-FGM5-X77Q vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.2-fips, openstack-keystone-2025.2, openstack-keystone-2025.1-fips, openstack-keystone-2026.1-fips, openstack-keystone-2025.1, openstack-keystone-2026.1...

CVE-2026-43000 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.2-fips, openstack-keystone-2025.2, openstack-keystone-2025.1-fips, openstack-keystone-2026.1-fips, openstack-keystone-2025.1, openstack-keystone-2026.1...

PYSEC-2026-619 Openstack Aodh can be used to launder Keystone trusts

Aodh as packaged in Openstack Ocata and Newton before change-ID I8fd11a7f9fe3c0ea5f9843a89686ac06713b7851 and before Pike-rc1 does not verify that trust IDs belong to the user when creating alarm action with the scheme trust+http, which allows remote authenticated users with knowledge of trust ID...

PYSEC-2026-651 OpenStack Identity (Keystone) Denial of Service

OpenStack Identity Keystone before 2013.1 allows remote attackers to cause a denial of service memory consumption and crash via multiple long requests...

PYSEC-2026-649 OpenStack Identity Keystone is vulnerable to Block delegation escalation of privilege

OpenStack Identity Keystone before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 does not properly handle chained delegation, which allows remote authenticated users to gain privileges by leveraging a 1 trust or 2 OAuth token with impersonation enabled to create a new token with...

PYSEC-2026-653 OpenStack Identity Keystone Exposure of Sensitive Information

The catalog url replacement in OpenStack Identity Keystone before 2013.2.3 and 2014.1 before 2014.1.2.1 allows remote authenticated users to read sensitive configuration options via a crafted endpoint, as demonstrated by "$admintoken" in the publicurl endpoint field...

PYSEC-2026-654 OpenStack Identity Keystone Improper Privilege Management

OpenStack Identity Keystone before 2014.1.1 does not properly handle when a role is assigned to a group that has the same ID as a user, which allows remote authenticated users to gain privileges that are assigned to a group with the same ID...

PYSEC-2026-650 OpenStack Keystone Denial of Service vulnerability via a large HTTP request

OpenStack Keystone Grizzly before 2013.1, Folsom, and possibly earlier allows remote attackers to cause a denial of service CPU and memory consumption via a large HTTP request, as demonstrated by a long tenantname when requesting a token...