openstack-keystone: OpenStack Keystone: Unauthorized access and privilege escalation via AWS signature validation flaw

A flaw was found in OpenStack Keystone. This vulnerability allows an attacker to obtain a valid OpenStack's Keystone token, leading to access to unauthorized resources or privilege escalation within the OpenStack instance via sending a valid AWS Amazon Web Services signature to the /v3/ec2tokens ...

OpenStack Keystone: OpenStack Keystone: Unauthorized cross-project access due to improper validation in EC2 credential creation

A flaw was found in OpenStack Keystone. An attacker holding an unrestricted application credential could exploit a vulnerability in the POST /v3/credentials endpoint where the caller-supplied projectid for an EC2-type credential was not validated against the project of the authenticating...

openstack-keystone: OpenStack Keystone: Privilege escalation through EC2 credential creation

A flaw was found in OpenStack Keystone. An authenticated user with a reader role can exploit a vulnerability in the EC2 credential creation endpoint. By using a restricted application credential to call the EC2 credential creation API, the user may obtain EC2/S3 credentials that carry the full se...

RHSA-2026:39808 Red Hat Security Advisory: Red Hat OpenStack Services on OpenShift 18.0 (openstack-keystone) security update

Bulletin has no description...

openstack-keystone: OpenStack Keystone: Privilege escalation through EC2 credential creation

A flaw was found in OpenStack Keystone. An authenticated user with a reader role can exploit a vulnerability in the EC2 credential creation endpoint. By using a restricted application credential to call the EC2 credential creation API, the user may obtain EC2/S3 credentials that carry the full se...

OpenStack Keystone: OpenStack Keystone: Unauthorized cross-project access due to improper validation in EC2 credential creation

A flaw was found in OpenStack Keystone. An attacker holding an unrestricted application credential could exploit a vulnerability in the POST /v3/credentials endpoint where the caller-supplied projectid for an EC2-type credential was not validated against the project of the authenticating...

Important: Red Hat Security Advisory: Red Hat OpenStack Services on OpenShift 18.0 (openstack-keystone) security update

An update for openstack-keystone is now available for Red Hat OpenStack Services on OpenShift 18.0 Antelope. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

PYSEC-2026-2549 OpenStack Identity Keystone and keystonemiddleware Insufficiently Protected Credentials

The identity service in OpenStack Identity Keystone before 2015.1.3 Kilo and 8.0.x before 8.0.2 Liberty and keystonemiddleware formerly python-keystoneclient before 1.5.4 Kilo and Liberty before 2.3.3 does not properly invalidate authorization tokens when using the PKI or PKIZ token providers,...

PYSEC-2026-2413 OpenStack Keystone and other components vulnerable to Improper Certificate Validation

HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side SSL certificates...

PYSEC-2026-830 OpenStack Keystone allows information disclosure during account locking

OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclosure during account locking related to PCI DSS features. By guessing the name of an account and failing to authenticate multiple times, any unauthenticated...

PYSEC-2026-802 XML External Entity (XXE) in Django

The XML libraries for Python as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity XXE attack...

OpenStack Keystone does not invalidate existing tokens when granting or revoking roles

OpenStack Keystone before 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to retain the privileges of the revoked roles...

GHSA-8F8M-WRVR-WCVF vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.1, openstack-keystone-2025.2-fips, openstack-keystone-2025.1-fips, openstack-keystone-2026.1-fips, openstack-keystone-2026.1, openstack-keystone-2025.2...

CVE-2026-44394 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.1, openstack-keystone-2025.2-fips, openstack-keystone-2025.1-fips, openstack-keystone-2026.1-fips, openstack-keystone-2026.1, openstack-keystone-2025.2...

GHSA-Q623-F4J4-P4XJ vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.1, openstack-keystone-2025.2-fips, openstack-keystone-2025.1-fips, openstack-keystone-2026.1-fips, openstack-keystone-2026.1, openstack-keystone-2025.2...

CVE-2026-42998 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.1, openstack-keystone-2025.2-fips, openstack-keystone-2025.1-fips, openstack-keystone-2026.1-fips, openstack-keystone-2026.1, openstack-keystone-2025.2...

CVE-2026-42999 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.1, openstack-keystone-2025.2-fips, openstack-keystone-2025.1-fips, openstack-keystone-2026.1-fips, openstack-keystone-2026.1, openstack-keystone-2025.2...

GHSA-2R23-2G6V-2M5F vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.1, openstack-keystone-2025.2-fips, openstack-keystone-2025.1-fips, openstack-keystone-2026.1-fips, openstack-keystone-2026.1, openstack-keystone-2025.2...

GHSA-WHQR-FGM5-X77Q vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.1, openstack-keystone-2025.2-fips, openstack-keystone-2025.1-fips, openstack-keystone-2026.1-fips, openstack-keystone-2026.1, openstack-keystone-2025.2...

CVE-2026-43000 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.1, openstack-keystone-2025.2-fips, openstack-keystone-2025.1-fips, openstack-keystone-2026.1-fips, openstack-keystone-2026.1, openstack-keystone-2025.2...