VulertSecurity VulertSecurity

Vulnerability Database · PyPI · keystone · Version

keystone 28.0.0.0rc1

28.0.0.0rc1 is affected by 15 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to. The upgrade Vulert recommends: 30.0.0.

Critical 2 High 8 Medium 1 Low 0 Unrated 4

All keystone versions & vulnerabilities → Search the database for this package →
Released 11 Sep 2025 Licence Apache-2.0 Also known from other sources 10 Newer releases 69 Database updated 23/Oct/2026

Release and licence data published by PyPI. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

keystone 28.0.0.0rc1 vulnerabilities

15 vulnerabilities cover keystone 28.0.0.0rc1. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
CVE-2021-3563: Keystone Application Secret Verification Bypass Vulnerability 9.1 critical No fix published 29 Jun 2026
CVE-2021-3563: Openstack Keystone Incorrect Authorization vulnerability 9.1 critical No fix published 27 Aug 2022
CVE-2019-19687: OpenStack Keystone Credential Leakage 8.8 high No fix published 24 May 2022
CVE-2026-43001: OpenStack Keystone Incorrect Authorization Issue 7.9 high No fix published 01 May 2026
CVE-2026-40683: Keystone LDAP Identity Backend Boolean Conversion Flaw 7.7 high 28.0.1 13 Jul 2026
CVE-2026-40683: OpenStack Keystone LDAP Identity Backend Boolean Conversion Flaw 7.7 high 28.0.1 14 Apr 2026
CVE-2025-65073: Keystone Vulnerability in OpenStack Allows Unauthorized Access via AWS Signature 7.5 high 26.0.1 07 Jul 2026
CVE-2012-3542: Remote user account creation in OpenStack Keystone 7.5 high 2012.1 17 May 2022
OpenStack Identity service (keystone) Incorrect Authorization 7.2 high No fix published 13 May 2022
CVE-2017-2673: Keystone Authorization Check Flaw in OpenStack Identity Service 7.2 high No fix published 19 Jul 2018
CVE-2012-4413: Keystone Token Management Vulnerability in OpenStack N/A unrated 2012.1.3 06 Jul 2026
CVE-2012-4413: OpenStack Keystone does not invalidate existing tokens when granting or revoking roles N/A medium 2012.1.3 17 May 2022
CVE-2012-5563: OpenStack Keystone Token Chaining Authorization Bypass N/A unrated 38c7e46a640a94da4da89a39a5a1ea9c081f1eb5 18 Dec 2012
CVE-2012-5571: Keystone EC2 Token Authorization Bypass Vulnerability N/A unrated 37308dd4f3e33f7bd0f71d83fd51734d1870713b 18 Dec 2012
CVE-2012-3542: OpenStack Keystone Arbitrary User Addition N/A unrated 5438d3b5a219d7c8fa67e66e538d325a61617155 05 Sep 2012

Looking for another version, or everything Vulert holds for keystone?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About keystone 28.0.0.0rc1

Is keystone 28.0.0.0rc1 vulnerable?

Yes. 15 vulnerabilities in the Vulert database cover keystone 28.0.0.0rc1: 2 critical, 8 high, 1 medium and 0 low, plus 4 not yet rated. The upgrade Vulert recommends is 30.0.0, and each entry above names the fixed version to move to.

Which version of keystone should I use instead of 28.0.0.0rc1?

30.0.0 is the version Vulert recommends for this release line. The version table on the package page lists every release with the vulnerabilities recorded against it.

Is 28.0.0.0rc1 the latest release of keystone?

No. 28.0.0.0rc1 was published 11 Sep 2025, and newer releases exist. Newer is not automatically safer — the version table on the package page shows what each release carries.

How do I monitor keystone for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the keystone version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.