CVE-2020-12692: OpenStack Keystone EC2 API Signature TTL Check Bypass
Summary
CVE-2020-12692: An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Affects keystone versions < 15.0.1. Fixed in 15.0.1. How to fix ↓
Also tracked for
- keystone · Debian:11
The same CVE-2020-12692 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenStack Keystone is an open-source identity service that provides authentication and authorization for other OpenStack services. It allows users to obtain tokens to access various resources within an OpenStack cloud environment. The EC2 API is a component of Keystone that provides compatibility with Amazon Web Services (AWS) EC2 API. This vulnerability affects versions of Keystone before 15.0.1 and 16.0.0.
Vulnerability Detail
The EC2 API in OpenStack Keystone does not enforce a signature TTL (Time To Live) check for AWS Signature V4. This allows an attacker to intercept the Authorization header, which contains the signed request information, and reuse it to generate new OpenStack tokens indefinitely. By exploiting this vulnerability, an attacker can gain unauthorized access to resources within the OpenStack environment.
How To Fix
Latest published version: 30.0.0 as of 22 Oct 2026
pip install --upgrade "keystone==30.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
15.0.1
This is the first release that contains the fix.
pip install --upgrade "keystone==15.0.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to upgrade to the fixed version of Keystone to mitigate the risk.
Conclusion
The vulnerability in OpenStack Keystone's EC2 API allows an attacker to bypass the signature TTL check for AWS Signature V4, leading to unauthorized access to OpenStack resources. It is crucial to upgrade to Keystone version 15.0.1 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for keystone →
FAQ
OpenStack Keystone is an open-source identity service that provides authentication and authorization for other OpenStack services.
The EC2 API is a component of Keystone that provides compatibility with Amazon Web Services (AWS) EC2 API.
AWS Signature V4 is a method used to sign requests to AWS services for authentication and integrity verification.
By exploiting this vulnerability, an attacker can intercept the Authorization header and generate new OpenStack tokens, granting unauthorized access to resources within the OpenStack environment.
To fix this vulnerability, upgrade to Keystone version 15.0.1 or later, which includes a fix for the signature TTL check in the EC2 API.
Related vulnerabilities
Recent vulnerabilities recorded for keystone.
