CVE-2019-19687: OpenStack Keystone Data Leakage in list credentials API
Summary
CVE-2019-19687: OpenStack Keystone Credential Leakage. Affects keystone across 2 version ranges.
>= 15.0.0, < 15.0.1
>= 16.0.0, < 16.0.1
Fixed in 15.0.1 or 16.0.1, depending on the release line you run. How to fix ↓
Also tracked for
- keystone · Debian:11
The same CVE-2019-19687 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenStack Keystone is an open-source identity service that provides authentication and authorization for other OpenStack services. It manages user credentials and access control policies. The Keystone package is available on PyPI and is widely used in OpenStack deployments. This vulnerability affects versions 15.0.0 and 16.0.0 of Keystone.
Vulnerability Detail
The list credentials API in OpenStack Keystone allows any user with a role on a project to list any credentials when the enforce_scope configuration is set to false. This means that users with a role on a project can view the credentials of other users, potentially exposing sensitive information such as Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. The issue has been assigned CVE-2019-19687.
How To Fix
Latest published version: 30.0.0 as of 22 Oct 2026
pip install --upgrade "keystone==30.0.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 15.0.0, < 15.0.115.0.1pip install --upgrade "keystone==15.0.1" -
>= 16.0.0, < 16.0.116.0.1pip install --upgrade "keystone==16.0.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a temporary workaround is to enable enforce_scope in the Keystone configuration. By setting enforce_scope to true, the list credentials API will only return credentials for the requesting user, preventing data leakage. Here is an example of how to enable enforce_scope in the Keystone configuration file:
[identity] enforce_scope = true
Conclusion
OpenStack Keystone versions 15.0.0 and 16.0.0 are affected by a data leakage vulnerability in the list credentials API. Users with a role on a project can view the credentials of other users, potentially exposing sensitive information. It is recommended to upgrade to version 16.0.1 or later of the Keystone package to fix this vulnerability. If immediate upgrade is not possible, enabling enforce_scope in the Keystone configuration can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for keystone →
FAQ
OpenStack Keystone is an open-source identity service that provides authentication and authorization for other OpenStack services. It manages user credentials and access control policies.
Versions 15.0.0 and 16.0.0 of Keystone are affected by this vulnerability.
The vulnerability allows users with a role on a project to view the credentials of other users, potentially exposing sensitive information such as Time-based One Time Passwords (TOTP).
To fix this vulnerability, it is recommended to upgrade to version 16.0.1 or later of the Keystone package.
A temporary workaround is to enable enforce_scope in the Keystone configuration.
References
Related vulnerabilities
Recent vulnerabilities recorded for keystone.
