Iniciar sesión
Deutsch English Español Polski
Media

OpenStack Keystone doesn't verify that the user supplied in the authentication request matches the owner of the application credential

  • Publicada: 28.05.2026
  • Actualizado: 11.10.2026 15:17

An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone application credential authentication plugin does not verify that the user supplied in the authentication request matches the owner of the application credential. An attacker can authenticate with their own application credential ID and secret while specifying a different user's name and domain in the request body. Keystone issues a token attributed to the victim user. The impersonated token is project-scoped and carries the intersection of the application credential's roles and the victim's actual roles on the project. This enables audit evasion, reading the victim's credentials, and acting as the victim within shared projects.

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

PlataformaPaqueteVersiones vulnerablesCorregida en
Python (PyPI) keystone >= 14.0.0, < 27.0.2, >= 28.0.0, < 28.0.2, >= 29.0.0, < 29.0.2 27.0.2, 28.0.2, 29.0.2

Referencias

Puntuación CVSS 6/10
Vector CVSS
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L
Debilidad (CWE)
CWE-863
Plataforma
Python (PyPI)
Paquete
keystone
Publicada
28.05.2026
Actualizado
11.10.2026 15:17

Fuentes y licencias

OSV / GitHub Advisory Database - PYSEC-2026-599 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-8f8m-wrvr-wcvf - CC BY 4.0

Historial de vulnerabilidades: keystone

Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (42) en el archivo
Entradas en total
42
Primera → última
09.2012 05.2026
Sin corrección
3
Explotada en ataques
0

Distribución por gravedad

  • Crítica 1
  • Alta 18
  • Media 21
  • Baja 1
  • Sin evaluar 1

Divulgaciones por año

antes: 13

Gravedad:
  1. OpenStack Keystone doesn't verify that the user supplied in the authentication request matches the owner of the application credential esta entrada
    Media · 6.0 CVE-2026-42998 >= 14.0.0, < 27.0.2, >= 28.0.0, < 28.0.2, >= 29.0.0, < 29.0.2 27.0.2, 28.0.2, 29.0.2
  2. OpenStack Keystone has an Incorrect Authorization Issue
    Alta · 7.9 CVE-2026-43001 >= 13.0.0, <= 29.0.1 sin corrección
  3. OpenStack Keystone: LDAP identity backend does not convert enabled attribute to boolean
    Alta · 7.7 CVE-2026-40683 < 28.0.1 28.0.1
  4. OpenStack Keystone allows /v3/ec2tokens or /v3/s3tokens request with valid AWS Signature to provide Keystone authorization.
    Alta · 7.5 CVE-2025-65073 < 26.0.1, >= 27.0.0.0rc1, < 27.0.0, >= 28.0.0.0rc1, < 28.0.0 26.0.1, 27.0.0, 28.0.0
  5. Openstack Keystone Incorrect Authorization vulnerability
    Crítica · 9.1 CVE-2021-3563 <= 21.0.0 sin corrección
  6. OpenStack Keystone allows information disclosure during account locking
    Alta · 7.5 CVE-2021-38155 >= 10.0, < 16.0.2, >= 17.0, < 17.0.1, >= 18.0, < 18.0.1, >= 19.0, < 19.0.1 16.0.2, 17.0.1, 18.0.1, 19.0.1
  7. OpenStack Keystone Improper Authentication vulnerability
    Alta CVE-2012-4456 >= 2012.1, < 2012.1.2 2012.1.2
  8. An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any user authenticated within a limited scope (trust/oauth/application credential) can create an EC2 credential with an escalat
    Alta · 8.8 CVE-2020-12689 < 15.0.1 15.0.1
  9. An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any authenticated user can create an EC2 credential for themselves for a project that they have a specified role on, and then p
    Alta · 8.8 CVE-2020-12691 < 15.0.1 15.0.1
  10. Insufficient Session Expiration in OpenStack Keystone
    Alta · 8.8 CVE-2020-12690 < 15.0.1, >= 16.0.0.0rc1, < 16.0.0 15.0.1, 16.0.0
  11. OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforc
    Alta · 8.8 CVE-2019-19687 < 16.0.1 16.0.1
  12. An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service (keystone). An authenticated federated user could request permissions to a project and uninten
    Alta · 7.2 CVE-2017-2673 >= 9.0.0, < 10.0.2, >= 11.0.0, < 11.0.1 10.0.2, 11.0.1
  13. OpenStack Identity Keystone and keystonemiddleware Insufficiently Protected Credentials
    Alta · 7.5 CVE-2015-7546 >= 8.0, < 8.1.0, >= 9.0.0.0b1, < 9.0.0.0b2 8.1.0, 9.0.0.0b2
  14. OpenStack Identity (Keystone) Multiple vulnerabilities in revocation events
    Alta · 6.5 CVE-2014-5251 < 8.0.0a0 8.0.0a0
  15. OpenStack Identity (Keystone) UUID v2 tokens does not expire with revocation events
    Alta · 6.5 CVE-2014-5252 < 8.0.0a0 8.0.0a0
  16. OpenStack Keystone Domain-scoped tokens don't get revoked
    Alta · 6.5 CVE-2014-5253 < 8.0.0a0 8.0.0a0
  17. OpenStack Identity (Keystone) DoS through V3 API authentication chaining
    Alta · 7.5 CVE-2014-2828 < 8.0.0a0 8.0.0a0
  18. OpenStack Identity (Keystone) Trustee token revocations does not work with memcache backend
    Alta · 6.5 CVE-2014-2237 < 8.0.0a0 8.0.0a0
  19. OpenStack Keystone, as used in OpenStack Folsom 2012.2, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by creating
    Alta · 5.9 CVE-2012-5563 todas las versiones sin corrección
  20. OpenStack Keystone Allows Remote User Account Creation
    Alta · 7.5 CVE-2012-3542 < 2012.1 2012.1

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación
Newsletter DockRay

La seguridad de tus aplicaciones en tu correo

Vulnerabilidades importantes, recomendaciones concretas y consejos prácticos para tus aplicaciones. Elige tus tecnologías y sigue lo que importa para tu proyecto.

  • Un resumen diario de nuevas vulnerabilidades, también las críticas.
  • Avisos sobre actualizaciones importantes.
  • Consejos prácticos sobre seguridad y monitorización de aplicaciones.

Déjalo vacío para recibir avisos de todas las tecnologías.

Política de privacidad

Suscripción gratuita. Date de baja con un clic en cualquier correo.