CVE-2026-115642

In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-restricted application credential may bypass those restrictions resulting in elevation of privileges...

CVE-2026-115642

A vulnerability exists in OpenStack keystonemiddleware and Keystone prior to version 13.0.2 . The software incorrectly treats the presence of the X-Service-Token HTTP header as sufficient to bypass access_rules enforcement and related token-binding checks. An attacker possessing an application cr...

CVE-2026-115642

In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-restricted application credential may bypass those restrictions resulting in elevation of privileges...

CVE-2026-22797

An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The externaloauth2token middleware fails to sanitize incoming authentication headers before processing OAuth 2.0 tokens. By sending forged...

EUVD-2015-0028

Malware in sbrugna...

GHSA-7F2C-VP52-GMFW OpenStack keystonemiddleware does not verify certificate

OpenStack keystonemiddleware formerly python-keystoneclient 0.x before 0.11.0 and 1.x before 1.2.0 disables certification verification when the "insecure" option is set in a paste configuration paste.ini file regardless of the value, which allows remote attackers to conduct man-in-the-middle...

PT-2015-5472

Name of the Vulnerable Software and Affected Versions OpenStack keystonemiddleware versions prior to 1.6.0 python-keystoneclient versions prior to 1.4.0 Description The issue allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate when the insecure option is set in ...

UBUNTU-CVE-2015-1852

The s3token middleware in OpenStack keystonemiddleware before 1.6.0 and python-keystoneclient before 1.4.0 disables certification verification when the "insecure" option is set in a paste configuration paste.ini file regardless of the value, which allows remote attackers to conduct...

CVE-2014-7144: Undefined Security Weakness

OpenStack keystonemiddleware formerly python-keystoneclient 0.x before 0.11.0 and 1.x before 1.2.0 disables certification verification when the "insecure" option is set in a paste configuration paste.ini file regardless of the value, which allows remote attackers to conduct man-in-the-middle...

PT-2014-7804

Name of the Vulnerable Software and Affected Versions OpenStack keystonemiddleware versions 0.x through 0.10.x OpenStack keystonemiddleware versions 1.x through 1.1.x Description The issue allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate when the insecure...