CVE-2020-12691: OpenStack Keystone EC2 Credential Masquerade
Summary
CVE-2020-12691: An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Affects keystone versions < 15.0.1. Fixed in 15.0.1. How to fix ↓
Also tracked for
- keystone · Debian:11
The same CVE-2020-12691 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenStack Keystone is an open-source identity service that provides authentication and authorization for other OpenStack services. It manages user credentials and access control policies. The Keystone package is available on PyPI and is widely used in OpenStack deployments. However, prior to versions 15.0.1 and 16.0.0, a vulnerability exists that allows an authenticated user to create an EC2 credential for themselves in a project where they have a specified role. This user can then update the credential user and project, enabling them to masquerade as another user. This can potentially grant the malicious user global admin privileges, allowing them to act as the admin on a project where another user has the admin role.
Vulnerability Detail
The vulnerability in OpenStack Keystone allows an authenticated user to create an EC2 credential and modify the associated user and project. By exploiting this vulnerability, a malicious user can impersonate another user with admin privileges on a project. This can lead to unauthorized access and potential misuse of global admin privileges. The vulnerability is present in versions prior to 15.0.1 and 16.0.0 of the Keystone package.
How To Fix
Latest published version: 30.0.0 as of 22 Oct 2026
pip install --upgrade "keystone==30.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
15.0.1
This is the first release that contains the fix.
pip install --upgrade "keystone==15.0.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of the Keystone package to mitigate the risk.
Conclusion
The vulnerability in OpenStack Keystone allows an authenticated user to create an EC2 credential and masquerade as another user with admin privileges. To mitigate this risk, it is crucial to upgrade to version 15.0.1 or later of the Keystone package. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for keystone →
FAQ
OpenStack Keystone is an open-source identity service that provides authentication and authorization for other OpenStack services.
The vulnerability allows an authenticated user to masquerade as another user with admin privileges on a project, potentially granting them global admin privileges.
Versions prior to 15.0.1 and 16.0.0 of the Keystone package are affected.
No, there is no known workaround. It is necessary to upgrade to the fixed version of the Keystone package.
To fix this vulnerability, upgrade to version 15.0.1 or later of the Keystone package.
Related vulnerabilities
Recent vulnerabilities recorded for keystone.
