CVE-2015-3646: Keystone Logs Passwords Vulnerability in OpenStack
Summary
CVE-2015-3646: OpenStack Keystone Logs Passwords. Affects keystone across 2 version ranges.
>= 2011.3, < 2014.1.5
>= 2014.2, < 2014.2.4
Fixed in 2014.1.5 or 2014.2.4, depending on the release line you run. How to fix ↓
Also tracked for
- keystone · Debian:11
The same CVE-2015-3646 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenStack Keystone is the identity service used for authentication and authorization in OpenStack cloud environments. It provides a central directory of users and their associated permissions, enabling secure access to cloud resources. Keystone is widely used in cloud deployments, making its security critical. However, prior to versions 2014.1.5 and 2014.2.4, Keystone had a vulnerability that allowed sensitive information, including passwords, to be logged, exposing it to unauthorized access.
Vulnerability Detail
The vulnerability arises from the logging of the 'backend_argument' configuration option in Keystone logs. This logging behavior allows remote authenticated users to read the logs and potentially obtain sensitive information, such as passwords and other backend details. The issue is particularly concerning as it can lead to unauthorized access to cloud resources and compromise user accounts.
How To Fix
Latest published version: 30.0.0 as of 22 Oct 2026
pip install --upgrade "keystone==30.0.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2011.3, < 2014.1.52014.1.5pip install --upgrade "keystone==2014.1.5" -
>= 2014.2, < 2014.2.42014.2.4pip install --upgrade "keystone==2014.2.4"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can restrict access to the Keystone logs to prevent unauthorized users from reading them. This can be done by modifying the file permissions of the log files to ensure that only authorized personnel can access them.
Conclusion
The CVE-2015-3646 vulnerability in OpenStack Keystone poses significant risks by exposing sensitive information through log files. It is crucial for users to update to the latest patched versions and implement security best practices to mitigate these risks.
See every vulnerability recorded for keystone →
FAQ
CVE-2015-3646 is a vulnerability in OpenStack Keystone that allows remote authenticated users to access sensitive information, including passwords, through log files.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Keystone versions prior to 2014.1.5 and 2014.2.x before 2014.2.4 are affected by this vulnerability.
The risks include unauthorized access to sensitive information, which can lead to compromised user accounts and potential breaches of cloud resources.
To secure your Keystone installation, ensure you are using a patched version, restrict log file access, and regularly audit your security configurations.
Related vulnerabilities
Recent vulnerabilities recorded for keystone.
