Description
OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.)
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | keystone | 2:16.0.0-5 | — |
| Debian 13 | keystone | 2:16.0.0-5 | — |
| Debian 12 | keystone | 2:16.0.0-5 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 16 | python3-keystone +1 | 1:16.0.1-0.20191210095025.bd3f637.el8ost | RHEA-2020:0283 |
| Red Hat OpenStack 16 | python3-mistral +8 | 9.0.2-0.20191125120837.6651519.el8ost | RHEA-2020:0283 |
| Red Hat OpenStack 15 | python3-keystone +1 | 1:15.0.1-0.20190720060412.5f27c4b.1.el8ost | RHSA-2019:4358 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | keystone | >= 15.0.0, < 15.0.1 | 15.0.1 | GHSA-2j23-fwqm-mgwr |
| PyPI | keystone | >= 16.0.0, < 16.0.1 | 16.0.1 | GHSA-2j23-fwqm-mgwr |
| PyPI | keystone | < 16.0.1 | 16.0.1 | PYSEC-2019-29 |
Advisories 2
- RHEA-2020:0283 Red Hat Enhancement Advisory: Red Hat OpenStack Platform 16.0 GA Red Hat Security Advisories (RHSA) · Aug 1, 2026
- RHSA-2019:4358 Red Hat Security Advisory: openstack-keystone security update Red Hat Security Advisories (RHSA) · Aug 1, 2026
References
- https://bugs.launchpad.net/keystone/+bug/1855080
- https://review.opendev.org/#/c/697355/
- https://review.opendev.org/#/c/697611/
- https://review.opendev.org/#/c/697731/
- https://security.openstack.org/ossa/OSSA-2019-006.html
- [oss-security] 20191211 [OSSA-2019-006] Keystone: Credentials API allows listing and retrieving of all users credentials (CVE-2019-19687) mailing-list
- RHSA-2019:4358 vendor-advisory
- USN-4262-1 vendor-advisory