VulertSecurity VulertSecurity

Vulnerability Database · PyPI · keystone · Version

keystone 26.0.0.0rc1

26.0.0.0rc1 is affected by 29 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to. The upgrade Vulert recommends: 30.0.0.

Critical 2 High 14 Medium 6 Low 1 Unrated 6

All keystone versions & vulnerabilities → Search the database for this package →
Released 12 Sep 2024 Licence non-standard Also known from other sources 21 Newer releases 69 Database updated 23/Oct/2026

Release and licence data published by PyPI. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

keystone 26.0.0.0rc1 vulnerabilities

29 vulnerabilities cover keystone 26.0.0.0rc1. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
CVE-2021-3563: Keystone Application Secret Verification Bypass Vulnerability 9.1 critical No fix published 29 Jun 2026
CVE-2021-3563: Openstack Keystone Incorrect Authorization vulnerability 9.1 critical No fix published 27 Aug 2022
CVE-2026-43000: Keystone Application Credential Impersonation Vulnerability Leading to Admin Escalation 8.8 high 27.0.2 28 May 2026
CVE-2026-42999: Keystone RBAC Policy Enforcer Vulnerability Allows Unauthorized Access 8.8 high 27.0.2 28 May 2026
CVE-2026-42998: Keystone Application Credential Authentication Bypass Vulnerability 8.8 high 27.0.2 28 May 2026
CVE-2019-19687: OpenStack Keystone Credential Leakage 8.8 high No fix published 24 May 2022
CVE-2026-44394: Keystone Token Rescoping Vulnerability Allows Indefinite Access 8.1 high 27.0.2 28 May 2026
CVE-2026-43001: Keystone EC2 Credential Misconfiguration Vulnerability 8.0 high 27.0.2 01 May 2026
CVE-2026-43001: OpenStack Keystone Incorrect Authorization Issue 7.9 high No fix published 01 May 2026
CVE-2026-40683: Keystone LDAP Identity Backend Boolean Conversion Flaw 7.7 high 28.0.1 13 Jul 2026
CVE-2026-40683: OpenStack Keystone LDAP Identity Backend Boolean Conversion Flaw 7.7 high 28.0.1 14 Apr 2026
CVE-2025-65073: Keystone Vulnerability in OpenStack Allows Unauthorized Access via AWS Signature 7.5 high 26.0.1 07 Jul 2026
CVE-2025-65073: OpenStack Keystone Vulnerability in EC2 and S3 Token Requests 7.5 high 26.0.1 17 Nov 2025
CVE-2012-3542: Remote user account creation in OpenStack Keystone 7.5 high 2012.1 17 May 2022
OpenStack Identity service (keystone) Incorrect Authorization 7.2 high No fix published 13 May 2022
CVE-2017-2673: Keystone Authorization Check Flaw in OpenStack Identity Service 7.2 high No fix published 19 Jul 2018
CVE-2026-42998: OpenStack Keystone Application Credential Authentication Bypass Vulnerability 6.0 medium 27.0.2 28 May 2026
CVE-2026-42999: OpenStack Keystone Authorization Bypass Vulnerability 6.0 medium 27.0.2 28 May 2026
CVE-2026-43000: OpenStack Keystone Incorrect Authorization Vulnerability 6.0 medium 27.0.2 28 May 2026
CVE-2026-44394: OpenStack Keystone Token Rescoping Expiry Bypass Vulnerability 6.0 medium 27.0.2 28 May 2026
CVE-2026-33551: Keystone EC2 Credential Bypass Vulnerability 5.3 medium 26.1.1 10 Apr 2026
CVE-2026-33551: OpenStack Keystone - EC2 Credential Creation Bypass via Restricted Application Credentials 3.5 low 26.1.1 10 Apr 2026
CVE-2012-4413: Keystone Token Management Vulnerability in OpenStack N/A unrated 2012.1.3 06 Jul 2026
CVE-2012-4413: OpenStack Keystone does not invalidate existing tokens when granting or revoking roles N/A medium 2012.1.3 17 May 2022
CVE-2013-2006: Keystone Admin Token and LDAP Password Exposure in OpenStack Identity N/A unrated c5037dd6b82909efaaa8720e8cfa8bdb8b4a0edd 21 May 2013
CVE-2012-5571: Keystone EC2 Token Authorization Bypass Vulnerability N/A unrated 37308dd4f3e33f7bd0f71d83fd51734d1870713b 18 Dec 2012
CVE-2012-5563: OpenStack Keystone Token Chaining Authorization Bypass N/A unrated 38c7e46a640a94da4da89a39a5a1ea9c081f1eb5 18 Dec 2012
CVE-2012-3542: OpenStack Keystone Arbitrary User Addition N/A unrated 5438d3b5a219d7c8fa67e66e538d325a61617155 05 Sep 2012
CVE-2012-3426: Keystone Token Expiration Bypass Vulnerability N/A unrated ea03d05ed5de0c015042876100d37a6a14bf56de 31 Jul 2012

Looking for another version, or everything Vulert holds for keystone?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About keystone 26.0.0.0rc1

Is keystone 26.0.0.0rc1 vulnerable?

Yes. 29 vulnerabilities in the Vulert database cover keystone 26.0.0.0rc1: 2 critical, 14 high, 6 medium and 1 low, plus 6 not yet rated. The upgrade Vulert recommends is 30.0.0, and each entry above names the fixed version to move to.

Which version of keystone should I use instead of 26.0.0.0rc1?

30.0.0 is the version Vulert recommends for this release line. The version table on the package page lists every release with the vulnerabilities recorded against it.

Is 26.0.0.0rc1 the latest release of keystone?

No. 26.0.0.0rc1 was published 12 Sep 2024, and newer releases exist. Newer is not automatically safer — the version table on the package page shows what each release carries.

How do I monitor keystone for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the keystone version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.