OpenStack Keystone vulnerabilities

CVEs per yearBy the year they were published

1. 20191
2. 20251
3. 202611

Newest CVEs

• CVE-2026-90460

  An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods (EC2 credentials, application credentials,…

  OpenStack · Keystone

  High7.6
• CVE-2026-80183

  In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignment under any domain…

  OpenStack · Keystone

  High7.1
• CVE-2026-80184

  In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms (OAuth1 access tokens, application credentials, trusts) could be…

  OpenStack · Keystone

  High7.6
• CVE-2026-80182

  In OpenStack Keystone before 29.0.3, tokens obtained via OAuth1 access token, application credential, or trust-scoped authentication could create new…

  OpenStack · Keystone

  High7.6
• CVE-2026-44394

  An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone federated token rescoping mechanism does not propagate the original token's expiry to…

  OpenStack · Keystone

  Medium6.0
• CVE-2026-43000

  An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation vulnerability, an attacker with the…

  OpenStack · Keystone

  Medium6.0
• CVE-2026-42999

  An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone RBAC policy enforcer in enforce_call unconditionally merges the raw JSON request body…

  OpenStack · Keystone

  Medium6.0
• CVE-2026-42998

  An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone application credential authentication plugin does not verify that the user supplied…

  OpenStack · Keystone

  Medium6.0
• CVE-2026-43001

  An issue was discovered in OpenStack Keystone before 29.0.2. POST /v3/credentials did not validate that the caller-supplied project_id for an EC2-type…

  OpenStack · Keystone

  High7.9
• CVE-2026-40683

  In OpenStack Keystone before 28.0.1, the LDAP identity backend does not convert the user enabled attribute to a boolean when the user_enabled_invert…

  OpenStack · Keystone

  High7.7