CVE-2020-12690: Insufficient Session Expiration in OpenStack Keystone
Summary
CVE-2020-12690: Insufficient Session Expiration in OpenStack Keystone. Affects keystone across 2 version ranges.
< 15.0.1
>= 16.0.0.0rc1, < 16.0.0
Fixed in 15.0.1 or 16.0.0, depending on the release line you run. How to fix ↓
Also tracked for
- keystone · Debian:11
The same CVE-2020-12690 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenStack Keystone is an open-source identity service used for authentication and authorization within the OpenStack cloud computing platform. It provides a central directory of users mapped to the OpenStack services they can access. Keystone supports multiple forms of authentication, including OAuth1 access tokens. These tokens are used to request a keystone token, which grants access to various resources and services within the OpenStack environment.
Vulnerability Detail
The vulnerability identified as CVE-2020-12690 in OpenStack Keystone versions before 15.0.1 and 16.0.0 involves an issue with session expiration. When an OAuth1 access token is used to request a keystone token, the list of roles provided for the access token is silently ignored. As a result, the resulting keystone token contains every role assignment the creator had for the project, potentially granting unintended escalated access. This means that the keystone token may have more role assignments than intended, leading to unauthorized access to sensitive resources and data.
How To Fix
Latest published version: 30.0.0 as of 22 Oct 2026
pip install --upgrade "keystone==30.0.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 15.0.115.0.1pip install --upgrade "keystone==15.0.1" -
>= 16.0.0.0rc1, < 16.0.016.0.0pip install --upgrade "keystone==16.0.0"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the patched versions of OpenStack Keystone.
Conclusion
The vulnerability identified as CVE-2020-12690 in OpenStack Keystone can lead to unintended escalated access within the OpenStack environment. It is crucial to upgrade to the patched versions of OpenStack Keystone to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for keystone →
FAQ
OpenStack Keystone is an open-source identity service used for authentication and authorization within the OpenStack cloud computing platform. It provides a central directory of users mapped to the OpenStack services they can access.
The vulnerability allows for unintended escalated access, potentially granting unauthorized users access to sensitive resources and data within the OpenStack environment.
Versions of OpenStack Keystone before 15.0.1 and 16.0.0 are affected by this vulnerability.
No, there is no known workaround for this vulnerability. It is crucial to upgrade to the patched versions of OpenStack Keystone.
To fix this vulnerability, it is recommended to upgrade to OpenStack Keystone version 15.0.1 or later, or version 16.0.0 or later.
Related vulnerabilities
Recent vulnerabilities recorded for keystone.
