openstack-keystone: OpenStack Keystone: Privilege escalation through EC2 credential creation

A flaw was found in OpenStack Keystone. An authenticated user with a reader role can exploit a vulnerability in the EC2 credential creation endpoint. By using a restricted application credential to call the EC2 credential creation API, the user may obtain EC2/S3 credentials that carry the full se...

OpenStack Keystone: OpenStack Keystone: Unauthorized cross-project access due to improper validation in EC2 credential creation

A flaw was found in OpenStack Keystone. An attacker holding an unrestricted application credential could exploit a vulnerability in the POST /v3/credentials endpoint where the caller-supplied projectid for an EC2-type credential was not validated against the project of the authenticating...

Important: Red Hat Security Advisory: Red Hat OpenStack Services on OpenShift 18.0 (openstack-keystone) security update

An update for openstack-keystone is now available for Red Hat OpenStack Services on OpenShift 18.0 Antelope. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

PYSEC-2026-2549 OpenStack Identity Keystone and keystonemiddleware Insufficiently Protected Credentials

The identity service in OpenStack Identity Keystone before 2015.1.3 Kilo and 8.0.x before 8.0.2 Liberty and keystonemiddleware formerly python-keystoneclient before 1.5.4 Kilo and Liberty before 2.3.3 does not properly invalidate authorization tokens when using the PKI or PKIZ token providers,...

PYSEC-2026-2413 OpenStack Keystone and other components vulnerable to Improper Certificate Validation

HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side SSL certificates...

PYSEC-2026-830 OpenStack Keystone allows information disclosure during account locking

OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclosure during account locking related to PCI DSS features. By guessing the name of an account and failing to authenticate multiple times, any unauthenticated...

PYSEC-2026-802 XML External Entity (XXE) in Django

The XML libraries for Python as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity XXE attack...

OpenStack Keystone does not invalidate existing tokens when granting or revoking roles

OpenStack Keystone before 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to retain the privileges of the revoked roles...

OpenStack Keystone Token authorization for a user in a disabled tenant is allowed

OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-3 does not properly handle authorization tokens for disabled tenants, which allows remote authenticated users to access the tenant's resources by requesting a token for the tenant...

CVE-2026-44394 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.2-fips, openstack-keystone-2025.1-fips, openstack-keystone-2025.1, openstack-keystone-2025.2, openstack-keystone-2026.1-fips, openstack-keystone-2026.1...

GHSA-8F8M-WRVR-WCVF vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.2-fips, openstack-keystone-2025.1-fips, openstack-keystone-2025.1, openstack-keystone-2025.2, openstack-keystone-2026.1-fips, openstack-keystone-2026.1...

GHSA-Q623-F4J4-P4XJ vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.2-fips, openstack-keystone-2025.1-fips, openstack-keystone-2025.1, openstack-keystone-2025.2, openstack-keystone-2026.1-fips, openstack-keystone-2026.1...

CVE-2026-42998 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.2-fips, openstack-keystone-2025.1-fips, openstack-keystone-2025.1, openstack-keystone-2025.2, openstack-keystone-2026.1-fips, openstack-keystone-2026.1...

CVE-2026-42999 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.2-fips, openstack-keystone-2025.1-fips, openstack-keystone-2025.1, openstack-keystone-2025.2, openstack-keystone-2026.1-fips, openstack-keystone-2026.1...

GHSA-WHQR-FGM5-X77Q vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.2-fips, openstack-keystone-2025.1-fips, openstack-keystone-2025.1, openstack-keystone-2025.2, openstack-keystone-2026.1-fips, openstack-keystone-2026.1...

GHSA-2R23-2G6V-2M5F vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.2-fips, openstack-keystone-2025.1-fips, openstack-keystone-2025.1, openstack-keystone-2025.2, openstack-keystone-2026.1-fips, openstack-keystone-2026.1...

CVE-2026-43000 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.2-fips, openstack-keystone-2025.1-fips, openstack-keystone-2025.1, openstack-keystone-2025.2, openstack-keystone-2026.1-fips, openstack-keystone-2026.1...

PYSEC-2026-649 OpenStack Identity Keystone is vulnerable to Block delegation escalation of privilege

OpenStack Identity Keystone before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 does not properly handle chained delegation, which allows remote authenticated users to gain privileges by leveraging a 1 trust or 2 OAuth token with impersonation enabled to create a new token with...

PYSEC-2026-654 OpenStack Identity Keystone Improper Privilege Management

OpenStack Identity Keystone before 2014.1.1 does not properly handle when a role is assigned to a group that has the same ID as a user, which allows remote authenticated users to gain privileges that are assigned to a group with the same ID...

PYSEC-2026-650 OpenStack Keystone Denial of Service vulnerability via a large HTTP request

OpenStack Keystone Grizzly before 2013.1, Folsom, and possibly earlier allows remote attackers to cause a denial of service CPU and memory consumption via a large HTTP request, as demonstrated by a long tenantname when requesting a token...