CVE-2020-12689: OpenStack Keystone EC2 Credential Escalation
Summary
CVE-2020-12689: An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Affects keystone versions < 15.0.1. Fixed in 15.0.1. How to fix ↓
Also tracked for
- keystone · Debian:11
The same CVE-2020-12689 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenStack Keystone is an open-source identity service used in cloud computing platforms. It provides authentication and authorization services for other OpenStack services. Keystone allows users to manage access to cloud resources through various authentication methods and role-based access controls. However, a vulnerability in Keystone versions before 15.0.1 and 16.0.0 allows authenticated users with limited scope to create an EC2 credential with escalated permissions. This means that a malicious user can obtain admin privileges while being on a limited viewer role, potentially granting them global admin privileges and compromising the security of the system.
Vulnerability Detail
The vulnerability (CVE-2020-12689) in OpenStack Keystone allows an authenticated user with limited scope to create an EC2 credential with escalated permissions. By exploiting this vulnerability, a malicious user can act as an admin on a project where another user has the admin role, effectively granting themselves global admin privileges. This can lead to unauthorized access, data breaches, and unauthorized modification of resources within the affected OpenStack environment.
How To Fix
Latest published version: 30.0.0 as of 22 Oct 2026
pip install --upgrade "keystone==30.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
15.0.1
This is the first release that contains the fix.
pip install --upgrade "keystone==15.0.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of OpenStack Keystone to mitigate the risk of exploitation.
Conclusion
The vulnerability (CVE-2020-12689) in OpenStack Keystone allows authenticated users with limited scope to create EC2 credentials with escalated permissions, potentially granting them global admin privileges. To mitigate this risk, it is crucial to upgrade to OpenStack Keystone version 15.0.1 or later. This upgrade will prevent the creation of EC2 credentials with escalated permissions and ensure the security of the OpenStack environment. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for keystone →
FAQ
OpenStack Keystone is an open-source identity service used in cloud computing platforms. It provides authentication and authorization services for other OpenStack services.
The vulnerability allows an authenticated user with limited scope to create an EC2 credential with escalated permissions, potentially granting them global admin privileges. This can lead to unauthorized access, data breaches, and unauthorized modification of resources within the affected OpenStack environment.
To fix this vulnerability, it is recommended to upgrade to OpenStack Keystone version 15.0.1 or later. This upgrade will prevent users with limited scope from creating EC2 credentials with escalated permissions.
There is no known workaround for this vulnerability. It is crucial to upgrade to the fixed version of OpenStack Keystone to mitigate the risk of exploitation.
For more information about this vulnerability, you can refer to the official OpenStack Keystone advisory at https://github.com/pypa/advisory-database/blob/main/vulns/keystone/PYSEC-2020-53.yaml
Related vulnerabilities
Recent vulnerabilities recorded for keystone.
