VulertSecurity VulertSecurity

Vulnerability Database · PyPI · keystone · Version

keystone 29.0.0

29.0.0 is affected by 17 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to. The upgrade Vulert recommends: 30.0.0.

Critical 2 High 10 Medium 1 Low 0 Unrated 4

All keystone versions & vulnerabilities → Search the database for this package →
Released 01 Apr 2026 Licence Apache-2.0 Also known from other sources 15 Newer releases 69 Database updated 23/Oct/2026

Release and licence data published by PyPI. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

keystone 29.0.0 vulnerabilities

17 vulnerabilities cover keystone 29.0.0. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
CVE-2021-3563: Keystone Application Secret Verification Bypass Vulnerability 9.1 critical No fix published 29 Jun 2026
CVE-2021-3563: Openstack Keystone Incorrect Authorization vulnerability 9.1 critical No fix published 27 Aug 2022
CVE-2026-43000: Keystone Application Credential Impersonation Vulnerability Leading to Admin Escalation 8.8 high 27.0.2 28 May 2026
CVE-2026-42998: Keystone Application Credential Authentication Bypass Vulnerability 8.8 high 27.0.2 28 May 2026
CVE-2026-42999: Keystone RBAC Policy Enforcer Vulnerability Allows Unauthorized Access 8.8 high 27.0.2 28 May 2026
CVE-2019-19687: OpenStack Keystone Credential Leakage 8.8 high No fix published 24 May 2022
CVE-2026-44394: Keystone Token Rescoping Vulnerability Allows Indefinite Access 8.1 high 27.0.2 28 May 2026
CVE-2026-43001: Keystone EC2 Credential Misconfiguration Vulnerability 8.0 high 27.0.2 01 May 2026
CVE-2026-43001: OpenStack Keystone Incorrect Authorization Issue 7.9 high No fix published 01 May 2026
CVE-2012-3542: Remote user account creation in OpenStack Keystone 7.5 high 2012.1 17 May 2022
OpenStack Identity service (keystone) Incorrect Authorization 7.2 high No fix published 13 May 2022
CVE-2017-2673: Keystone Authorization Check Flaw in OpenStack Identity Service 7.2 high No fix published 19 Jul 2018
CVE-2012-4413: Keystone Token Management Vulnerability in OpenStack N/A unrated 2012.1.3 06 Jul 2026
CVE-2012-4413: OpenStack Keystone does not invalidate existing tokens when granting or revoking roles N/A medium 2012.1.3 17 May 2022
CVE-2012-5571: Keystone EC2 Token Authorization Bypass Vulnerability N/A unrated 37308dd4f3e33f7bd0f71d83fd51734d1870713b 18 Dec 2012
CVE-2012-5563: OpenStack Keystone Token Chaining Authorization Bypass N/A unrated 38c7e46a640a94da4da89a39a5a1ea9c081f1eb5 18 Dec 2012
CVE-2012-3542: OpenStack Keystone Arbitrary User Addition N/A unrated 5438d3b5a219d7c8fa67e66e538d325a61617155 05 Sep 2012

Looking for another version, or everything Vulert holds for keystone?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About keystone 29.0.0

Is keystone 29.0.0 vulnerable?

Yes. 17 vulnerabilities in the Vulert database cover keystone 29.0.0: 2 critical, 10 high, 1 medium and 0 low, plus 4 not yet rated. The upgrade Vulert recommends is 30.0.0, and each entry above names the fixed version to move to.

Which version of keystone should I use instead of 29.0.0?

30.0.0 is the version Vulert recommends for this release line. The version table on the package page lists every release with the vulnerabilities recorded against it.

Is 29.0.0 the latest release of keystone?

No. 29.0.0 was published 01 Apr 2026, and newer releases exist. Newer is not automatically safer — the version table on the package page shows what each release carries.

How do I monitor keystone for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the keystone version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.