OpenStack Keystone EC2 Credential Escalation

keystone Updated 02 Oct 2025

Summary

24/05/2022

Disclosed on

CVE-2020-12689

CVE

Yes i

Fix available

High

Severity

8.8

CVSS Score

CVE-2020-12689: OpenStack Keystone EC2 and/or credential endpoints are not protected from a scoped context. Affects keystone across 2 version ranges.

< 15.0.1 >= 16.0.0, < 16.0.1

Fixed in 15.0.1 or 16.0.1, depending on the release line you run. How to fix ↓

Also tracked for

keystone · Debian:11

The same CVE-2020-12689 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

OpenStack Keystone is an open-source identity service used for authentication and authorization in OpenStack cloud environments. It provides a central directory of users mapped to the OpenStack services they can access. Keystone supports various authentication methods and allows users to obtain temporary credentials, such as EC2 credentials, for accessing resources within the cloud. However, a vulnerability has been discovered in Keystone versions before 15.0.1 and 16.0.0 that allows users with limited scope authentication to create EC2 credentials with escalated permissions, potentially granting them global admin privileges.

Vulnerability Detail

The vulnerability in OpenStack Keystone allows an authenticated user with limited scope (trust/oauth/application credential) to create an EC2 credential with escalated permissions. This means that a user with a limited viewer role can create an EC2 credential that grants them admin privileges, even if they are not authorized as an admin on the project. This can lead to a malicious user acting as an admin on a project where another user has the admin role, effectively granting them global admin privileges. The vulnerability has a CVSS score of 8.8, indicating a high severity.

How To Fix

Latest published version: 30.0.0 as of 22 Oct 2026

pip install --upgrade "keystone==30.0.0"

Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.

If you can't move to the latest

The minimum fixed version depends on the release line you run.

< 15.0.1 15.0.1

pip install --upgrade "keystone==15.0.1"

>= 16.0.0, < 16.0.1 16.0.1

pip install --upgrade "keystone==16.0.1"

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Workaround

There is no known workaround for this vulnerability. It is necessary to upgrade to the fixed versions of Keystone to mitigate the risk.

Conclusion

OpenStack Keystone versions before 15.0.1 and 16.0.0 are vulnerable to an EC2 credential escalation vulnerability. This allows authenticated users with limited scope to create EC2 credentials with escalated permissions, potentially granting them global admin privileges. To mitigate this vulnerability, it is crucial to upgrade to the fixed versions of Keystone. For further assistance and support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for keystone →

FAQ

What is OpenStack Keystone?

What is the impact of this vulnerability?

The vulnerability allows an authenticated user with limited scope to create an EC2 credential with escalated permissions, potentially granting them global admin privileges. This can lead to unauthorized access and control over projects and resources within the OpenStack environment.

Which versions of Keystone are affected?

Versions of Keystone before 15.0.1 and 16.0.0 are affected by this vulnerability.

How can I fix this vulnerability?

To fix this vulnerability, it is recommended to upgrade to the fixed versions of Keystone. For versions before 15.0.1, upgrade to version 15.0.1 or later. For versions 16.0.0, upgrade to version 16.0.1 or later.

Is there a workaround for this vulnerability?

There is no known workaround for this vulnerability. It is necessary to upgrade to the fixed versions of Keystone to mitigate the risk.

References

Related vulnerabilities

Recent vulnerabilities recorded for keystone.

View all keystone vulnerabilities →