Keystone

This hub aggregates every CVE we track for Keystone, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Keystone.

• CVE-2026-90460An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods (EC2 credentials, application credentials, OAuth1 access tokens, and trusts) are no...Sep 11, 2026
• CVE-2026-80183In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignment under any domain by passing a domain ID as scope.project...Aug 26, 2026
• CVE-2026-80184In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms (OAuth1 access tokens, application credentials, trusts) could be submitted to the token-method authentic...Aug 25, 2026
• CVE-2026-80182In OpenStack Keystone before 29.0.3, tokens obtained via OAuth1 access token, application credential, or trust-scoped authentication could create new long-lived credentials or authorize new delegat...Aug 25, 2026
• CVE-2026-63421Keystone: `graphql.maxTake` bypass with negative `take`7.5Aug 21, 2026
• CVE-2026-10802keystonejs keystone GraphQL API Endpoint output-field.ts resource consumption4.3Jun 4, 2026
• CVE-2026-44394An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone federated token rescoping mechanism does not propagate the original token's expiry to the newly issued token. When a federa...6.0May 28, 2026
• CVE-2026-43000An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation vulnerability, an attacker with the member role on a project can escalate to ...6.0May 28, 2026
• CVE-2026-42998An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone application credential authentication plugin does not verify that the user supplied in the authentication request matches t...6.0May 28, 2026
• CVE-2026-42999An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone RBAC policy enforcer in enforce_call unconditionally merges the raw JSON request body into the policy enforcement dictionar...6.0May 28, 2026
• CVE-2026-43001An issue was discovered in OpenStack Keystone before 29.0.2. POST /v3/credentials did not validate that the caller-supplied project_id for an EC2-type credential matched the project of the authenti...7.9May 1, 2026
• CVE-2026-40683In OpenStack Keystone before 28.0.1, the LDAP identity backend does not convert the user enabled attribute to a boolean when the user_enabled_invert configuration option is False (the default). The...7.7Apr 14, 2026
• CVE-2026-33551An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0. Restricted application credentials can create EC2 credentials. By using a restricted applicati...3.5Apr 10, 2026
• CVE-2026-33326@keystone-6/core: `isFilterable` bypass via `cursor` parameter in findMany4.3Mar 24, 2026
• CVE-2025-65073OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Signature to provide Keystone authorization.7.5Nov 17, 2025