CVE-2019-19687: OpenStack Keystone Data Leakage in list credentials API
Summary
PYSEC-2019-99: OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Affects keystone versions < 16.0.1. Fixed in 16.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenStack Keystone is an open-source identity service that provides authentication and authorization for other OpenStack services. It manages user credentials and access control policies. The Keystone package is available on PyPI (Python Package Index) and is widely used in OpenStack deployments. However, versions 15.0.0 and 16.0.0 of Keystone are affected by a data leakage vulnerability in the list credentials API.
Vulnerability Detail
The vulnerability allows any user with a role on a project to list any credentials using the /v3/credentials API when enforce_scope is set to false. This means that users with a role on a project can view other users' credentials, potentially exposing sensitive information such as Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. The issue will be fixed in version 16.0.1 of Keystone, but it should be noted that there will be a slight performance impact on the list credentials API after the fix.
How To Fix
Latest published version: 30.0.0 as of 22 Oct 2026
pip install --upgrade "keystone==30.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
16.0.1
This is the first release that contains the fix.
pip install --upgrade "keystone==16.0.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to version 16.0.1 is not immediately possible, a workaround is to enable enforce_scope in the Keystone configuration. By setting enforce_scope to true, the vulnerability can be mitigated. However, it should be noted that this workaround may have implications on the functionality or performance of the system.
Conclusion
OpenStack Keystone versions 15.0.0 and 16.0.0 are affected by a data leakage vulnerability in the list credentials API. Users with a role on a project can view other users' credentials, potentially exposing sensitive information. It is recommended to upgrade to version 16.0.1 of the Keystone package to fix this vulnerability. If immediate upgrade is not possible, enabling enforce_scope in the configuration can serve as a workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for keystone →
FAQ
OpenStack Keystone is an open-source identity service that provides authentication and authorization for other OpenStack services.
Versions 15.0.0 and 16.0.0 of Keystone are affected.
The vulnerability allows users with a role on a project to view other users' credentials, potentially exposing sensitive information.
Upgrade to version 16.0.1 of the Keystone package.
Enabling enforce_scope in the Keystone configuration can mitigate the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for keystone.
