VulertSecurity VulertSecurity

Vulnerability Database · PyPI · keystone · Version

keystone 15.0.0

15.0.0 is affected by 41 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to. The upgrade Vulert recommends: 30.0.0.

Critical 2 High 20 Medium 6 Low 1 Unrated 12

All keystone versions & vulnerabilities → Search the database for this package →
Released 10 Apr 2019 Licence non-standard Also known from other sources 35 Newer releases 69 Database updated 23/Oct/2026

Release and licence data published by PyPI. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

keystone 15.0.0 vulnerabilities

41 vulnerabilities cover keystone 15.0.0. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
CVE-2021-3563: Keystone Application Secret Verification Bypass Vulnerability 9.1 critical No fix published 29 Jun 2026
CVE-2021-3563: Openstack Keystone Incorrect Authorization vulnerability 9.1 critical No fix published 27 Aug 2022
CVE-2026-43000: Keystone Application Credential Impersonation Vulnerability Leading to Admin Escalation 8.8 high 27.0.2 28 May 2026
CVE-2026-42999: Keystone RBAC Policy Enforcer Vulnerability Allows Unauthorized Access 8.8 high 27.0.2 28 May 2026
CVE-2026-42998: Keystone Application Credential Authentication Bypass Vulnerability 8.8 high 27.0.2 28 May 2026
CVE-2020-12691: OpenStack Keystone V3 /credentials endpoint policy logic allows to change credentials owner or target project ID 8.8 high 15.0.1 24 May 2022
OpenStack Keystone EC2 Credential Escalation 8.8 high 15.0.1 24 May 2022
CVE-2019-19687: OpenStack Keystone Data Leakage in list credentials API 8.8 high 15.0.1 24 May 2022
CVE-2019-19687: OpenStack Keystone Credential Leakage 8.8 high No fix published 24 May 2022
CVE-2020-12690: Insufficient Session Expiration in OpenStack Keystone 8.8 high 15.0.1 09 Jun 2021
CVE-2026-44394: Keystone Token Rescoping Vulnerability Allows Indefinite Access 8.1 high 27.0.2 28 May 2026
CVE-2026-43001: Keystone EC2 Credential Misconfiguration Vulnerability 8.0 high 27.0.2 01 May 2026
CVE-2026-43001: OpenStack Keystone Incorrect Authorization Issue 7.9 high No fix published 01 May 2026
CVE-2026-40683: Keystone LDAP Identity Backend Boolean Conversion Flaw 7.7 high 28.0.1 13 Jul 2026
CVE-2026-40683: OpenStack Keystone LDAP Identity Backend Boolean Conversion Flaw 7.7 high 28.0.1 14 Apr 2026
CVE-2025-65073: Keystone Vulnerability in OpenStack Allows Unauthorized Access via AWS Signature 7.5 high 26.0.1 07 Jul 2026
CVE-2021-38155: Keystone Information Disclosure During Account Locking 7.5 high 16.0.2 06 Jul 2026
CVE-2025-65073: OpenStack Keystone Vulnerability in EC2 and S3 Token Requests 7.5 high 26.0.1 17 Nov 2025
Information Disclosure in OpenStack Keystone 7.5 high 16.0.2 24 May 2022
CVE-2012-3542: Remote user account creation in OpenStack Keystone 7.5 high 2012.1 17 May 2022
OpenStack Identity service (keystone) Incorrect Authorization 7.2 high No fix published 13 May 2022
CVE-2017-2673: Keystone Authorization Check Flaw in OpenStack Identity Service 7.2 high No fix published 19 Jul 2018
CVE-2026-42999: OpenStack Keystone Authorization Bypass Vulnerability 6.0 medium 27.0.2 28 May 2026
CVE-2026-42998: OpenStack Keystone Application Credential Authentication Bypass Vulnerability 6.0 medium 27.0.2 28 May 2026
CVE-2026-43000: OpenStack Keystone Incorrect Authorization Vulnerability 6.0 medium 27.0.2 28 May 2026
CVE-2026-44394: OpenStack Keystone Token Rescoping Expiry Bypass Vulnerability 6.0 medium 27.0.2 28 May 2026
CVE-2026-33551: Keystone EC2 Credential Bypass Vulnerability 5.3 medium 26.1.1 10 Apr 2026
CVE-2026-33551: OpenStack Keystone - EC2 Credential Creation Bypass via Restricted Application Credentials 3.5 low 26.1.1 10 Apr 2026
CVE-2012-4413: Keystone Token Management Vulnerability in OpenStack N/A unrated 2012.1.3 06 Jul 2026
CVE-2012-4413: OpenStack Keystone does not invalidate existing tokens when granting or revoking roles N/A medium 2012.1.3 17 May 2022
CVE-2020-12689: OpenStack Keystone EC2 Credential Escalation N/A unrated 15.0.1 07 May 2020
CVE-2020-12692: OpenStack Keystone EC2 API Signature TTL Check Bypass N/A unrated 15.0.1 07 May 2020
CVE-2020-12691: OpenStack Keystone EC2 Credential Masquerade N/A unrated 15.0.1 07 May 2020
CVE-2020-12690: OpenStack Keystone OAuth1 Access Token Role Assignment Bypass N/A unrated 15.0.1 07 May 2020
CVE-2019-19687: OpenStack Keystone Data Leakage in list credentials API N/A unrated 16.0.1 09 Dec 2019
CVE-2019-19687: OpenStack Keystone Data Leakage in list credentials API N/A unrated 16.0.1 09 Dec 2019
CVE-2013-2006: Keystone Admin Token and LDAP Password Exposure in OpenStack Identity N/A unrated c5037dd6b82909efaaa8720e8cfa8bdb8b4a0edd 21 May 2013
CVE-2012-5563: OpenStack Keystone Token Chaining Authorization Bypass N/A unrated 38c7e46a640a94da4da89a39a5a1ea9c081f1eb5 18 Dec 2012
CVE-2012-5571: Keystone EC2 Token Authorization Bypass Vulnerability N/A unrated 37308dd4f3e33f7bd0f71d83fd51734d1870713b 18 Dec 2012
CVE-2012-3542: OpenStack Keystone Arbitrary User Addition N/A unrated 5438d3b5a219d7c8fa67e66e538d325a61617155 05 Sep 2012
CVE-2012-3426: Keystone Token Expiration Bypass Vulnerability N/A unrated ea03d05ed5de0c015042876100d37a6a14bf56de 31 Jul 2012

Looking for another version, or everything Vulert holds for keystone?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About keystone 15.0.0

Is keystone 15.0.0 vulnerable?

Yes. 41 vulnerabilities in the Vulert database cover keystone 15.0.0: 2 critical, 20 high, 6 medium and 1 low, plus 12 not yet rated. The upgrade Vulert recommends is 30.0.0, and each entry above names the fixed version to move to.

Which version of keystone should I use instead of 15.0.0?

30.0.0 is the version Vulert recommends for this release line. The version table on the package page lists every release with the vulnerabilities recorded against it.

Is 15.0.0 the latest release of keystone?

No. 15.0.0 was published 10 Apr 2019, and newer releases exist. Newer is not automatically safer — the version table on the package page shows what each release carries.

How do I monitor keystone for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the keystone version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.