PYSEC-2026-652 OpenStack Keystone allows context-dependent attackers to bypass access restrictions

OpenStack Keystone Grizzly before 2013.1, Folsom 2012.1.3 and earlier, and Essex does not properly check if the 1 user, 2 tenant, or 3 domain is enabled when using EC2-style authentication, which allows context-dependent attackers to bypass access restrictions...

PYSEC-2026-656 OpenStack Keystone and other components vulnerable to Improper Certificate Validation

HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side SSL certificates...

RHSA-2026:28044 Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (openstack-keystone) security update

Bulletin has no description...

GHSA-3J69-69WJ-XQX2 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.2-fips, openstack-horizon-2025.2, openstack-keystone-2025.1, openstack-glance-2025.1-fips, openstack-placement-2025.2, openstack-horizon-2026.1-fips, openstack-glance-2025.2-fips, openstack-placement-2025.2-fips, openstack-keystone-2026.1-fips...

CVE-2026-54911 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.2-fips, openstack-horizon-2025.2, openstack-keystone-2025.1, openstack-glance-2025.1-fips, openstack-placement-2025.2, openstack-horizon-2026.1-fips, openstack-glance-2025.2-fips, openstack-placement-2025.2-fips, openstack-keystone-2026.1-fips...

GHSA-6V7P-G79W-8964 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.2-fips, openstack-horizon-2025.2, openstack-keystone-2025.1, openstack-glance-2025.1-fips, request-1276, mitmproxy, openstack-placement-2025.2, openstack-horizon-2026.1-fips, kubeflow-katib, dbt-core, dask-kubernetes,...

RHEL 9 : Red Hat OpenStack Platform 17.1 (openstack-keystone) (RHSA-2026:28044)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:28044 advisory. Keystone is a Python implementation of the OpenStack http://www.openstack.org identity service API. Security Fixes: OpenStack Keystone:...

openstack-keystone: OpenStack Keystone: Unauthorized access and privilege escalation via AWS signature validation flaw

A flaw was found in OpenStack Keystone. This vulnerability allows an attacker to obtain a valid OpenStack's Keystone token, leading to access to unauthorized resources or privilege escalation within the OpenStack instance via sending a valid AWS Amazon Web Services signature to the /v3/ec2tokens ...

openstack-keystone: OpenStack Keystone: Privilege escalation through EC2 credential creation

A flaw was found in OpenStack Keystone. An authenticated user with a reader role can exploit a vulnerability in the EC2 credential creation endpoint. By using a restricted application credential to call the EC2 credential creation API, the user may obtain EC2/S3 credentials that carry the full se...

OpenStack Keystone: OpenStack Keystone: Unauthorized cross-project access due to improper validation in EC2 credential creation

A flaw was found in OpenStack Keystone. An attacker holding an unrestricted application credential could exploit a vulnerability in the POST /v3/credentials endpoint where the caller-supplied projectid for an EC2-type credential was not validated against the project of the authenticating...

Important: Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (openstack-keystone) security update

An update for openstack-keystone is now available for Red Hat OpenStack Platform 17.1 Wallaby. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : OpenStack Keystone vulnerabilities (USN-8433-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8433-1 advisory. It was discovered that OpenStack Keystone allowed restricted application credentials to create EC2 credentials. An...

GHSA-FHV5-28VV-H8M8 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.2-fips, litellm, netbox, openstack-horizon-2025.2, openstack-keystone-2025.1, openstack-glance-2025.1-fips, netbox-fips, openstack-placement-2025.2, openstack-horizon-2026.1-fips, openstack-glance-2025.2-fips, openstack-placement-2025.2-fips,...

CVE-2026-48524 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.2-fips, litellm, netbox, openstack-horizon-2025.2, openstack-keystone-2025.1, openstack-glance-2025.1-fips, netbox-fips, openstack-placement-2025.2, openstack-horizon-2026.1-fips, openstack-glance-2025.2-fips, openstack-placement-2025.2-fips,...

CVE-2026-48523 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.2-fips, litellm, netbox, openstack-horizon-2025.2, openstack-keystone-2025.1, openstack-glance-2025.1-fips, netbox-fips, openstack-placement-2025.2, openstack-horizon-2026.1-fips, openstack-glance-2025.2-fips, openstack-placement-2025.2-fips,...

CVE-2026-48526 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.2-fips, litellm, netbox, openstack-horizon-2025.2, openstack-keystone-2025.1, openstack-glance-2025.1-fips, netbox-fips, openstack-placement-2025.2, openstack-horizon-2026.1-fips, openstack-glance-2025.2-fips, openstack-placement-2025.2-fips,...

GHSA-JQ35-7PRP-9V3F vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.2-fips, litellm, netbox, openstack-horizon-2025.2, openstack-keystone-2025.1, openstack-glance-2025.1-fips, netbox-fips, openstack-placement-2025.2, openstack-horizon-2026.1-fips, openstack-glance-2025.2-fips, openstack-placement-2025.2-fips,...

GHSA-XGMM-8J9V-C9WX vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.2-fips, litellm, netbox, openstack-horizon-2025.2, openstack-keystone-2025.1, openstack-glance-2025.1-fips, netbox-fips, openstack-placement-2025.2, openstack-horizon-2026.1-fips, openstack-glance-2025.2-fips, openstack-placement-2025.2-fips,...

CVE-2026-48525 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.2-fips, litellm, netbox, openstack-horizon-2025.2, openstack-keystone-2025.1, openstack-glance-2025.1-fips, netbox-fips, openstack-placement-2025.2, openstack-horizon-2026.1-fips, openstack-glance-2025.2-fips, openstack-placement-2025.2-fips,...

GHSA-W7VC-732C-9M39 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.2-fips, litellm, netbox, openstack-horizon-2025.2, openstack-keystone-2025.1, openstack-glance-2025.1-fips, netbox-fips, openstack-placement-2025.2, openstack-horizon-2026.1-fips, openstack-glance-2025.2-fips, openstack-placement-2025.2-fips,...