CVE-2019-19687: OpenStack Keystone Data Leakage in list credentials API
Summary
CVE-2019-19687: OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Affects keystone versions < 16.0.1. Fixed in 16.0.1. How to fix ↓
Also tracked for
- keystone · Debian:11
The same CVE-2019-19687 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenStack Keystone is an open-source identity service used for authentication and authorization in OpenStack cloud environments. It provides a central directory of users mapped to the OpenStack services they can access. Keystone is responsible for issuing and validating tokens used for authentication. The list credentials API allows users to view their own credentials. However, a vulnerability in Keystone versions 15.0.0 and 16.0.0 allows any user with a role on a project to list any credentials using the /v3/credentials API when enforce_scope is set to false. This means that users with a role on a project can view other users' credentials, potentially exposing sensitive information such as Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected.
Vulnerability Detail
The vulnerability in OpenStack Keystone allows unauthorized users to access and view other users' credentials. This can lead to data leakage and compromise the security of the system. The issue arises when enforce_scope is set to false, allowing any user with a role on a project to list credentials using the /v3/credentials API. This can expose sensitive information, such as TOTP sign-on details. It is important to note that there will be a slight performance impact on the list credentials API once the issue is fixed.
How To Fix
Latest published version: 30.0.0 as of 22 Oct 2026
pip install --upgrade "keystone==30.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
16.0.1
This is the first release that contains the fix.
pip install --upgrade "keystone==16.0.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a workaround is to enable enforce_scope in the Keystone configuration. By setting enforce_scope to true, the vulnerability can be mitigated. However, this may have an impact on the performance of the list credentials API.
Conclusion
The data leakage vulnerability in OpenStack Keystone can allow unauthorized users to access and view other users' credentials. It is crucial to upgrade to version 16.0.1 or later of the Keystone package to fix this issue. Alternatively, enabling enforce_scope in the Keystone configuration can provide a temporary workaround. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for keystone →
FAQ
OpenStack Keystone is an open-source identity service used for authentication and authorization in OpenStack cloud environments. It provides a central directory of users mapped to the OpenStack services they can access.
The list credentials API in Keystone allows users to view their own credentials. It is used for managing and accessing authentication credentials within the OpenStack environment.
The vulnerability allows unauthorized users to access and view other users' credentials. This can lead to data leakage and compromise the security of the system.
enforce_scope is a configuration option in Keystone that determines whether to enforce project scope for API requests. When set to false, it allows any user with a role on a project to list any credentials using the /v3/credentials API, leading to the data leakage vulnerability.
To fix the vulnerability, it is recommended to upgrade to version 16.0.1 or later of the Keystone package. This version includes a fix for the data leakage issue in the list credentials API.
Related vulnerabilities
Recent vulnerabilities recorded for keystone.
