CVE-2018-20170: User Enumeration Vulnerability in OpenStack Keystone
Summary
CVE-2018-20170: DISPUTED OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because invalid usernames have much faster responses than valid ones for a POST /v3/auth/tokens request. Affects keystone versions < 14.1.0. Fixed in 14.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenStack Keystone is a component of the OpenStack cloud computing platform that provides authentication and authorization services. It is responsible for managing user identities, roles, and permissions within an OpenStack deployment. The vulnerability identified as CVE-2018-20170 affects Keystone versions up to 14.0.1. This vulnerability allows an attacker to enumerate valid usernames by exploiting differences in response times for POST /v3/auth/tokens requests. By sending requests with both valid and invalid usernames, an attacker can determine which usernames are valid based on the response time. This information can be used for further attacks, such as brute-forcing passwords or targeted attacks on specific user accounts.
Vulnerability Detail
The user enumeration vulnerability in OpenStack Keystone arises from the discrepancy in response times for valid and invalid usernames during a POST /v3/auth/tokens request. When an invalid username is provided, the response time is significantly faster compared to a valid username. This discrepancy allows an attacker to distinguish between valid and invalid usernames by measuring the response time. By repeatedly sending requests with different usernames, an attacker can identify valid usernames and potentially gain unauthorized access to user accounts. It is important to note that the vendor considers this vulnerability as a hardening opportunity rather than a critical security issue.
How To Fix
Latest published version: 30.0.0 as of 22 Oct 2026
pip install --upgrade "keystone==30.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
14.1.0
This is the first release that contains the fix.
pip install --upgrade "keystone==14.1.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, as a general security measure, it is advisable to implement strong password policies, enable multi-factor authentication, and regularly monitor and review access logs for any suspicious activity.
Conclusion
The user enumeration vulnerability in OpenStack Keystone can be mitigated by upgrading to version 14.1.0 or later. It is crucial for users to keep their Keystone installations up to date to protect against potential unauthorized access and further attacks. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for keystone →
FAQ
OpenStack Keystone is a component of the OpenStack cloud computing platform that provides authentication and authorization services. It manages user identities, roles, and permissions within an OpenStack deployment.
The user enumeration vulnerability in OpenStack Keystone allows an attacker to determine valid usernames by exploiting response time differences. This information can be used for further attacks, such as brute-forcing passwords or targeted attacks on specific user accounts.
To fix this vulnerability, it is recommended to upgrade to OpenStack Keystone version 14.1.0 or later. Updating to the latest version includes improvements that mitigate the user enumeration vulnerability.
No specific workarounds are provided for this vulnerability. However, implementing strong password policies, enabling multi-factor authentication, and monitoring access logs can enhance overall security.
The vendor considers this vulnerability as a hardening opportunity rather than a critical security issue. However, it is still important to apply the recommended fix to ensure the security of OpenStack deployments.
References
Related vulnerabilities
Recent vulnerabilities recorded for keystone.
