Media

An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0. Restricted application credentials can create EC2 credentials. By using a restricted application

Publicada: 10.04.2026
Actualizado: 11.10.2026 12:19

An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0. Restricted application credentials can create EC2 credentials. By using a restricted application credential to call the EC2 credential creation API, an authenticated user with only a reader role may obtain an EC2/S3 credential that carries the full set of the parent user's S3 permissions, effectively bypassing the role restrictions imposed on the application credential. Only deployments that use restricted application credentials in combination with the EC2/S3 compatibility API (swift3 / s3api) are affected.

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

Plataforma	Paquete	Versiones vulnerables	Corregida en
Python (PyPI)	keystone	>= 14.0.0, < 26.1.1	26.1.1

Referencias

Puntuación CVSS 5.3/10

Vector CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Debilidad (CWE): CWE-863
Plataforma: Python (PyPI)
Paquete: keystone
Publicada: 10.04.2026
Actualizado: 11.10.2026 12:19

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-4phw-6824-6cfp - CC BY 4.0

OSV / GitHub Advisory Database - PYSEC-2026-202 - PyPA Advisory Database; CC BY 4.0

Historial de vulnerabilidades: keystone

Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (42) en el archivo

Entradas en total: 42
Primera → última: 09.2012 05.2026
Sin corrección: 3
Explotada en ataques: 0

Distribución por gravedad

Crítica 1
Alta 18
Media 21
Baja 1
Sin evaluar 1

Divulgaciones por año

2017: 0
2018: 2
2019: 1
2020: 4
2021: 0
2022: 14
2023: 0
2024: 0
2025: 1
2026: 7

antes: 13

01.05.2026

OpenStack Keystone has an Incorrect Authorization Issue

Alta · 7.9 CVE-2026-43001 >= 13.0.0, <= 29.0.1 sin corrección
14.04.2026

OpenStack Keystone: LDAP identity backend does not convert enabled attribute to boolean

Alta · 7.7 CVE-2026-40683 < 28.0.1 28.0.1
10.04.2026

An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0. Restricted application credentials can create EC2 credentials. By using a restricted application esta entrada

Media · 5.3 CVE-2026-33551 >= 14.0.0, < 26.1.1 26.1.1
17.11.2025

OpenStack Keystone allows /v3/ec2tokens or /v3/s3tokens request with valid AWS Signature to provide Keystone authorization.

Alta · 7.5 CVE-2025-65073 < 26.0.1, >= 27.0.0.0rc1, < 27.0.0, >= 28.0.0.0rc1, < 28.0.0 26.0.1, 27.0.0, 28.0.0
27.08.2022

Openstack Keystone Incorrect Authorization vulnerability

Crítica · 9.1 CVE-2021-3563 <= 21.0.0 sin corrección
24.05.2022

OpenStack Keystone allows information disclosure during account locking

Alta · 7.5 CVE-2021-38155 >= 10.0, < 16.0.2, >= 17.0, < 17.0.1, >= 18.0, < 18.0.1, >= 19.0, < 19.0.1 16.0.2, 17.0.1, 18.0.1, 19.0.1
14.05.2022

OpenStack Keystone Improper Authentication vulnerability

Alta CVE-2012-4456 >= 2012.1, < 2012.1.2 2012.1.2
07.05.2020

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any user authenticated within a limited scope (trust/oauth/application credential) can create an EC2 credential with an escalat

Alta · 8.8 CVE-2020-12689 < 15.0.1 15.0.1
07.05.2020

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any authenticated user can create an EC2 credential for themselves for a project that they have a specified role on, and then p

Alta · 8.8 CVE-2020-12691 < 15.0.1 15.0.1
07.05.2020

Insufficient Session Expiration in OpenStack Keystone

Alta · 8.8 CVE-2020-12690 < 15.0.1, >= 16.0.0.0rc1, < 16.0.0 15.0.1, 16.0.0
09.12.2019

OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforc

Alta · 8.8 CVE-2019-19687 < 16.0.1 16.0.1
19.07.2018

An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service (keystone). An authenticated federated user could request permissions to a project and uninten

Alta · 7.2 CVE-2017-2673 >= 9.0.0, < 10.0.2, >= 11.0.0, < 11.0.1 10.0.2, 11.0.1
03.02.2016

OpenStack Identity Keystone and keystonemiddleware Insufficiently Protected Credentials

Alta · 7.5 CVE-2015-7546 >= 8.0, < 8.1.0, >= 9.0.0.0b1, < 9.0.0.0b2 8.1.0, 9.0.0.0b2
25.08.2014

OpenStack Identity (Keystone) Multiple vulnerabilities in revocation events

Alta · 6.5 CVE-2014-5251 < 8.0.0a0 8.0.0a0
25.08.2014

OpenStack Identity (Keystone) UUID v2 tokens does not expire with revocation events

Alta · 6.5 CVE-2014-5252 < 8.0.0a0 8.0.0a0
25.08.2014

OpenStack Keystone Domain-scoped tokens don't get revoked

Alta · 6.5 CVE-2014-5253 < 8.0.0a0 8.0.0a0
15.04.2014

OpenStack Identity (Keystone) DoS through V3 API authentication chaining

Alta · 7.5 CVE-2014-2828 < 8.0.0a0 8.0.0a0
01.04.2014

OpenStack Identity (Keystone) Trustee token revocations does not work with memcache backend

Alta · 6.5 CVE-2014-2237 < 8.0.0a0 8.0.0a0
18.12.2012

OpenStack Keystone, as used in OpenStack Folsom 2012.2, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by creating

Alta · 5.9 CVE-2012-5563 todas las versiones sin corrección
05.09.2012

OpenStack Keystone Allows Remote User Account Creation

Alta · 7.5 CVE-2012-3542 < 2012.1 2012.1

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación