Is CVE-2014-3476 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2014-3476 being exploited in the wild.

How severe is CVE-2014-3476?

Informational severity, with a CVSS score of 6.8, published 2 July 2026.

Which products and versions are affected?

keystone (PyPI) ECOSYSTEM:introduced=0,fixed=8.0.0a0.

Is there a fix for CVE-2014-3476?

Yes. keystone (PyPI): upgrade to 8.0.0a0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2014-3476 attacked?

It is attacked over the network.

Am I affected by CVE-2014-3476?

Check whether you run keystone (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2014-3476: PYSEC-2026-649 - OpenStack Identity Keystone is vulnerable to Block delegation escalation of privilege

CVE-2014-3476 · Severity: info · CVSS 6.8 · Published 2026-07-02

OpenStack Keystone is an identity and access management service that controls user permissions and role delegation across cloud infrastructure. A flaw in how Keystone handles delegated access tokens allows authenticated users to bypass intended permission limits by creating additional delegation chains, gaining higher privileges than originally granted. This could allow an attacker with limited access to escalate to administrative roles and compromise the entire cloud environment.

Technologies: keystone (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2014-3476 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2014-3476 being exploited in the wild.
How severe is CVE-2014-3476?: Informational severity, with a CVSS score of 6.8, published 2 July 2026.
Which products and versions are affected?: keystone (PyPI) ECOSYSTEM:introduced=0,fixed=8.0.0a0.
Is there a fix for CVE-2014-3476?: Yes. keystone (PyPI): upgrade to 8.0.0a0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2014-3476 attacked?: It is attacked over the network.
Am I affected by CVE-2014-3476?: Check whether you run keystone (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

keystone (PyPI): upgrade to 8.0.0a0 or later
```
pip install "keystone>=8.0.0a0"
```

Technical details

This vulnerability is a privilege escalation in OpenStack Keystone's trust delegation mechanism (CWE-269: Improper Check of Insufficient Access Control). The root cause is that Keystone does not properly prevent the use of trust-scoped tokens to create additional trusts with expanded role sets. An authenticated remote user with impersonation-enabled delegation can obtain a trust-scoped token, then create a second trust with elevated roles not present in the original delegation, effectively bypassing the intended scope restrictions. This requires network access to Keystone and prior trust delegation with impersonation enabled. The fix prevents trust-scoped tokens from being used to create new trusts.

Affected products

OpenStack Keystone before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2

Identifiers

CVE-2014-3476
GHSA-274v-r947-v34r
PYSEC-2026-649

Timeline

2014-05-29: disclosed
2014-06-17: advisory
2014-06-17: patched: Fixed in Keystone 2013.2.4, 2014.1.2, and Juno-2

References

https://bugs.launchpad.net/keystone/+bug/1324592

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.