OpenStack Identity service (keystone) Incorrect Authorization
Summary
CVE-2017-2673: OpenStack Identity service (keystone) Incorrect Authorization. Affects keystone across 3 version ranges.
>= 9.0.0, <= 9.3.0
>= 10.0.0, < 10.0.2
>= 11.0.0, < 11.0.1
Fixed in 10.0.2 or 11.0.1, depending on the release line you run. How to fix ↓
Also tracked for
- keystone · Debian:11
The same CVE-2017-2673 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The OpenStack Identity service (keystone) is a component of the OpenStack cloud computing platform that provides authentication and authorization services. It allows users to manage and control access to various resources within the OpenStack environment. Keystone is a critical component for ensuring secure access to the cloud infrastructure.
Vulnerability Detail
An authorization-check flaw was discovered in the federation configurations of the OpenStack Identity service (keystone). This vulnerability allows an authenticated federated user to request permissions to a project and unintentionally be granted all related roles, including administrative roles. This could lead to unauthorized access and potential misuse of the OpenStack resources. The vulnerability has a CVSS score of 7.2, indicating a high severity.
How To Fix
Latest published version: 30.0.0 as of 22 Oct 2026
pip install --upgrade "keystone==30.0.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 10.0.0, < 10.0.210.0.2pip install --upgrade "keystone==10.0.2" -
>= 11.0.0, < 11.0.111.0.1pip install --upgrade "keystone==11.0.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the fix by upgrading to the recommended versions.
Conclusion
The OpenStack Identity service (keystone) Incorrect Authorization vulnerability allows authenticated federated users to gain unauthorized access to OpenStack resources. It is crucial to upgrade to the fixed versions (10.0.2 or 11.0.1) to mitigate the risk of unauthorized access and potential misuse of the OpenStack environment. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for keystone →
FAQ
The vulnerability allows an authenticated federated user to gain unauthorized access to OpenStack resources and potentially perform administrative actions.
OpenStack deployments using the affected versions of the keystone package are affected by this vulnerability.
There are no known public exploits for this vulnerability at the time of this advisory.
Yes, the vulnerability has been fixed in keystone versions 10.0.2 and 11.0.1.
You can use the Vulert Playground at Vulert Scanner to check if your OpenStack deployment is affected by this vulnerability. Simply upload your Pipfile.lock to the playground and it will provide real-time alerts for open-source vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for keystone.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
