keystone: OpenStack Keystone: Privilege escalation via chained application credential impersonation and trust misuse

A flaw was found in OpenStack Keystone. An attacker with a member role on a project can escalate their privileges to an administrator role. This is achieved by combining an application credential impersonation vulnerability with the misuse of Keystone trusts. The system incorrectly validates...

openstack-keystone: OpenStack Keystone: Privilege escalation through EC2 credential creation

A flaw was found in OpenStack Keystone. An authenticated user with a reader role can exploit a vulnerability in the EC2 credential creation endpoint. By using a restricted application credential to call the EC2 credential creation API, the user may obtain EC2/S3 credentials that carry the full se...

RHEL 7 : Red Hat OpenStack Platform 13.0 security advisory (Important) (RHSA-2026:94039)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:94039 advisory. Red Hat OpenStack Platform provides the facilities for building, deploying and monitoring a private or public infrastructure-as-a-service...

GHSA-2QM8-X737-GMW5 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2026.1-fips, openstack-octavia-2026.1, openstack-rally-2025.2, nemo-rl-cuda-13.0, aws-cli, sentry-fips, openstack-keystone-2026.2-fips, openstack-keystone-2026.2, nemo-skills, kserve-huggingfaceserver-cuda-13.3, sentry, dbt-bigquery,...

GHSA-9M75-VC3G-4X39 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2026.1-fips, openstack-octavia-2026.1, openstack-rally-2025.2, nemo-rl-cuda-13.0, aws-cli, sentry-fips, openstack-keystone-2026.2-fips, openstack-keystone-2026.2, nemo-skills, kserve-huggingfaceserver-cuda-13.3, sentry, dbt-bigquery,...

GHSA-FM9C-5RCF-2Q5P vulnerabilities

Vulnerabilities for packages: openstack-keystone-2026.1-fips, openstack-octavia-2026.1, openstack-rally-2025.2, nemo-rl-cuda-13.0, aws-cli, sentry-fips, openstack-keystone-2026.2-fips, openstack-keystone-2026.2, nemo-skills, kserve-huggingfaceserver-cuda-13.3, sentry, dbt-bigquery,...

GHSA-MM57-4V3P-RCHX vulnerabilities

Vulnerabilities for packages: openstack-keystone-2026.1-fips, openstack-octavia-2026.1, openstack-rally-2025.2, nemo-rl-cuda-13.0, aws-cli, sentry-fips, openstack-keystone-2026.2-fips, openstack-keystone-2026.2, nemo-skills, kserve-huggingfaceserver-cuda-13.3, sentry, dbt-bigquery,...

CVE-2026-119194 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2026.1-fips, openstack-octavia-2026.1, openstack-rally-2025.2, nemo-rl-cuda-13.0, aws-cli, sentry-fips, openstack-keystone-2026.2-fips, openstack-keystone-2026.2, nemo-skills, kserve-huggingfaceserver-cuda-13.3, sentry, dbt-bigquery,...

CVE-2026-119195 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2026.1-fips, openstack-octavia-2026.1, openstack-rally-2025.2, nemo-rl-cuda-13.0, aws-cli, sentry-fips, openstack-keystone-2026.2-fips, openstack-keystone-2026.2, nemo-skills, kserve-huggingfaceserver-cuda-13.3, sentry, dbt-bigquery,...

CVE-2026-119196 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2026.1-fips, openstack-octavia-2026.1, openstack-rally-2025.2, nemo-rl-cuda-13.0, aws-cli, sentry-fips, openstack-keystone-2026.2-fips, openstack-keystone-2026.2, nemo-skills, kserve-huggingfaceserver-cuda-13.3, sentry, dbt-bigquery,...

CVE-2026-119197 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2026.1-fips, openstack-octavia-2026.1, openstack-rally-2025.2, nemo-rl-cuda-13.0, aws-cli, sentry-fips, openstack-keystone-2026.2-fips, openstack-keystone-2026.2, nemo-skills, kserve-huggingfaceserver-cuda-13.3, sentry, dbt-bigquery,...

CVE-2013-2006

CVE-2013-2006 Version: https://github.com/openstack/keystone/blob/d43e2a51a1ed7adbed3c5ddf001d46bc4a824ae8...

CVE-2026-115642

A flaw was found in OpenStack keystonemiddleware and Keystone. The code incorrectly treats the presence of the X-Service-Token HTTP header as sufficient to skip enforcement of application credential access rules and can skip related token-binding checks. An attacker who holds an application...

OpenStack Keystone authorization issue vulnerability

Versions of OpenStack Keystone prior to 10.12.2, between 11.0.0 and 12.0.1, as well as between 13.0.0 and 13.0.2 contain an authorization issue vulnerability. This vulnerability stems from improper handling of the custom X-Service-Token header in requests. Attackers possessing access to restricte...

GHSA-GF2Q-J2QQ-PJF2 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2026.2...

CVE-2012-3542 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2026.2...

CVE-2012-4413 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2026.2...

GHSA-MRXV-65RV-6HXQ vulnerabilities

Vulnerabilities for packages: openstack-keystone-2026.2...

CVE-2026-90460

A flaw was found in OpenStack Keystone. Tokens obtained via delegated authentication methods trusts, application credentials, OAuth1 access tokens can move a credential to an unauthorized project by supplying a new projectid in a PATCH /v3/credentials request, because only the pre-update project ...

GHSA-42VR-XJ54-VC7V vulnerabilities

Vulnerabilities for packages: dagster, airflow-core, openstack-keystone-2025.2, openstack-keystone-2026.1-fips, openstack-octavia-2026.1, airflow-postgres-fips, nemo-rl-cuda-13.0, openstack-glance-2025.1-fips, datadog-agent-fips, openstack-keystone-2025.1, openstack-keystone-2025.2-fips,...