# keystone (PyPI) vulnerabilities Source: https://junglewise.ai/threats/technologies/keystone Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/keystone.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 47 vulnerabilities in keystone (PyPI): 0 in the last 7 days and 0 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2015-7546, was published on 9 July 2026. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 0 - All time: 47 (1 critical, 0 exploited in the wild) ## About keystone (PyPI) Python web framework and content management system for building data-driven applications. ## Latest keystone (PyPI) vulnerabilities - [CVE-2015-7546: PYSEC-2026-2549 - OpenStack Identity Keystone and keystonemiddleware Insufficiently Protected Credentials](https://junglewise.ai/threats/cve-2015-7546-openstack-identity-keystone-and-keystonemiddleware-insufficiently) (low, CVSS 3.1, published 9 Jul 2026) - [CVE-2021-38155: PYSEC-2026-830 - OpenStack Keystone allows information disclosure during account locking](https://junglewise.ai/threats/cve-2021-38155-openstack-keystone-allows-information-disclosure-during-account) (low, CVSS 3.1, published 6 Jul 2026) - [CVE-2013-4477: PYSEC-2026-831 - OpenStack Identity Keystone Privilege Escalation vulnerability](https://junglewise.ai/threats/cve-2013-4477-openstack-identity-keystone-privilege-escalation-vulnerability) (info, published 6 Jul 2026) - [CVE-2012-4413: PYSEC-2026-833 - OpenStack Keystone does not invalidate existing tokens when granting or revoking roles](https://junglewise.ai/threats/cve-2012-4413-openstack-keystone-does-not-invalidate-existing-tokens-when) (info, published 6 Jul 2026) - [CVE-2012-4456: PYSEC-2026-832 - OpenStack Keystone Improper Authentication vulnerability](https://junglewise.ai/threats/cve-2012-4456-openstack-keystone-improper-authentication-vulnerability) (info, published 6 Jul 2026) - [CVE-2012-4457: PYSEC-2026-834 - OpenStack Keystone Token authorization for a user in a disabled tenant is allowed](https://junglewise.ai/threats/cve-2012-4457-openstack-keystone-token-authorization-for-a-user-in-a-disabled) (info, published 6 Jul 2026) - [CVE-2014-3621: PYSEC-2026-653 - OpenStack Identity Keystone Exposure of Sensitive Information](https://junglewise.ai/threats/cve-2014-3621-openstack-identity-keystone-exposure-of-sensitive-information) (info, published 2 Jul 2026) - [CVE-2014-0204: PYSEC-2026-654 - OpenStack Identity Keystone Improper Privilege Management](https://junglewise.ai/threats/cve-2014-0204-openstack-identity-keystone-improper-privilege-management) (info, published 2 Jul 2026) - [CVE-2015-3646: PYSEC-2026-655 - OpenStack Keystone Logs Passwords](https://junglewise.ai/threats/cve-2015-3646-openstack-keystone-logs-passwords) (info, published 2 Jul 2026) - [CVE-2014-3476: PYSEC-2026-649 - OpenStack Identity Keystone is vulnerable to Block delegation escalation of privilege](https://junglewise.ai/threats/cve-2014-3476-openstack-keystone-privilege-escalation-via-trust-chaining) (info, CVSS 6.8, published 2 Jul 2026) - [CVE-2013-2014: PYSEC-2026-651 - OpenStack Identity (Keystone) Denial of Service](https://junglewise.ai/threats/cve-2013-2014-openstack-identity-keystone-denial-of-service) (info, published 2 Jul 2026) - [CVE-2013-0282: PYSEC-2026-652 - OpenStack Keystone allows context-dependent attackers to bypass access restrictions](https://junglewise.ai/threats/cve-2013-0282-openstack-keystone-allows-context-dependent-attackers-to-bypass) (info, published 2 Jul 2026) - [CVE-2013-0270: PYSEC-2026-650 - OpenStack Keystone Denial of Service vulnerability via a large HTTP request](https://junglewise.ai/threats/cve-2013-0270-openstack-keystone-denial-of-service-vulnerability-via-a-large) (low, CVSS 3.1, published 2 Jul 2026) - [CVE-2013-2255: PYSEC-2026-656 - OpenStack Keystone and other components vulnerable to Improper Certificate Validation](https://junglewise.ai/threats/cve-2013-2255-openstack-keystone-and-other-components-vulnerable-to-improper) (low, CVSS 3.1, published 2 Jul 2026) - [CVE-2026-44394: OpenStack Keystone authentication expiry bypass in federated token rescoping](https://junglewise.ai/threats/cve-2026-44394-openstack-keystone-authentication-expiry-bypass-in-federated) (medium, CVSS 6, published 28 May 2026) - [CVE-2026-43000: OpenStack Keystone privilege escalation via trust delegation](https://junglewise.ai/threats/cve-2026-43000-openstack-keystone-privilege-escalation-via-trust-delegation) (medium, CVSS 6, published 28 May 2026) - [CVE-2026-42999: OpenStack Keystone RBAC policy bypass via JSON request body injection](https://junglewise.ai/threats/cve-2026-42999-openstack-keystone-rbac-policy-bypass-via-json-request-body) (medium, CVSS 6, published 28 May 2026) - [CVE-2026-42998: OpenStack Keystone User Impersonation in Application Credentials](https://junglewise.ai/threats/cve-2026-42998-openstack-keystone-user-impersonation-in-application-credentials) (medium, CVSS 6, published 28 May 2026) - [CVE-2026-43001: OpenStack Keystone authorization bypass in EC2 credential creation](https://junglewise.ai/threats/cve-2026-43001-openstack-keystone-authorization-bypass-in-ec2-credential) (high, CVSS 7.9, published 1 May 2026) - [CVE-2026-40683: OpenStack Keystone incorrect LDAP user status handling](https://junglewise.ai/threats/cve-2026-40683-openstack-keystone-incorrect-ldap-user-status-handling) (high, CVSS 7.7, published 14 Apr 2026) - [CVE-2026-33551: OpenStack Keystone authorization bypass in EC2 credential creation](https://junglewise.ai/threats/cve-2026-33551-openstack-keystone-authorization-bypass-in-ec2-credential) (low, CVSS 3.5, published 10 Apr 2026) - [CVE-2025-65073: PYSEC-2026-1490 - OpenStack Keystone allows /v3/ec2tokens or /v3/s3tokens request with valid AWS Signature to provide…](https://junglewise.ai/threats/cve-2025-65073-openstack-keystone-allows-v3-ec2tokens-or-v3-s3tokens-request) (high, CVSS 7.5, published 17 Nov 2025) - [CVE-2021-3563: Openstack Keystone Incorrect Authorization vulnerability](https://junglewise.ai/threats/cve-2021-3563-openstack-keystone-incorrect-authorization-vulnerability) (critical, CVSS 9.1, published 27 Aug 2022) - [Keystone cross-site scripting](https://junglewise.ai/threats/keystone-cross-site-scripting-9990301e) (info, published 20 Aug 2020) - [CVE-2020-12692: OpenStack Keystone does not check signature TTL of the EC2 credential auth method](https://junglewise.ai/threats/cve-2020-12692-openstack-keystone-does-not-check-signature-ttl-of-the-ec2) (low, CVSS 3.1, published 7 May 2020) ## Most severe keystone (PyPI) vulnerabilities - [CVE-2021-3563: Openstack Keystone Incorrect Authorization vulnerability](https://junglewise.ai/threats/cve-2021-3563-openstack-keystone-incorrect-authorization-vulnerability) (critical, CVSS 9.1, published 27 Aug 2022) - [CVE-2026-43001: OpenStack Keystone authorization bypass in EC2 credential creation](https://junglewise.ai/threats/cve-2026-43001-openstack-keystone-authorization-bypass-in-ec2-credential) (high, CVSS 7.9, published 1 May 2026) - [CVE-2026-40683: OpenStack Keystone incorrect LDAP user status handling](https://junglewise.ai/threats/cve-2026-40683-openstack-keystone-incorrect-ldap-user-status-handling) (high, CVSS 7.7, published 14 Apr 2026) - [CVE-2025-65073: PYSEC-2026-1490 - OpenStack Keystone allows /v3/ec2tokens or /v3/s3tokens request with valid AWS Signature to provide…](https://junglewise.ai/threats/cve-2025-65073-openstack-keystone-allows-v3-ec2tokens-or-v3-s3tokens-request) (high, CVSS 7.5, published 17 Nov 2025) - [CVE-2026-43000: OpenStack Keystone privilege escalation via trust delegation](https://junglewise.ai/threats/cve-2026-43000-openstack-keystone-privilege-escalation-via-trust-delegation) (medium, CVSS 6, published 28 May 2026) - [CVE-2026-42999: OpenStack Keystone RBAC policy bypass via JSON request body injection](https://junglewise.ai/threats/cve-2026-42999-openstack-keystone-rbac-policy-bypass-via-json-request-body) (medium, CVSS 6, published 28 May 2026) - [CVE-2026-42998: OpenStack Keystone User Impersonation in Application Credentials](https://junglewise.ai/threats/cve-2026-42998-openstack-keystone-user-impersonation-in-application-credentials) (medium, CVSS 6, published 28 May 2026) - [CVE-2026-44394: OpenStack Keystone authentication expiry bypass in federated token rescoping](https://junglewise.ai/threats/cve-2026-44394-openstack-keystone-authentication-expiry-bypass-in-federated) (medium, CVSS 6, published 28 May 2026) - [CVE-2026-33551: OpenStack Keystone authorization bypass in EC2 credential creation](https://junglewise.ai/threats/cve-2026-33551-openstack-keystone-authorization-bypass-in-ec2-credential) (low, CVSS 3.5, published 10 Apr 2026) - [CVE-2020-12691: OpenStack Keystone V3 /credentials endpoint policy logic allows to change credentials owner or target project ID](https://junglewise.ai/threats/cve-2020-12691-openstack-keystone-v3-credentials-endpoint-policy-logic-allows-to) (low, CVSS 3.1, published 7 May 2020) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other PyPI technologies - [tensorflow (PyPI)](https://junglewise.ai/threats/technologies/pypi-tensorflow): 435 vulnerabilities - [tensorflow-cpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-cpu): 430 vulnerabilities - [tensorflow-gpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-gpu): 427 vulnerabilities - [open-webui (PyPI)](https://junglewise.ai/threats/technologies/open-webui): 177 vulnerabilities - [Django (PyPI)](https://junglewise.ai/threats/technologies/django): 173 vulnerabilities - [apache-airflow (PyPI)](https://junglewise.ai/threats/technologies/apache-airflow): 159 vulnerabilities - [pillow (PyPI)](https://junglewise.ai/threats/technologies/pillow): 125 vulnerabilities - [praisonai (PyPI)](https://junglewise.ai/threats/technologies/pypi-praisonai): 120 vulnerabilities - [vllm (PyPI)](https://junglewise.ai/threats/technologies/pypi-vllm): 117 vulnerabilities - [plone (PyPI)](https://junglewise.ai/threats/technologies/pypi-plone): 101 vulnerabilities - [mlflow (PyPI)](https://junglewise.ai/threats/technologies/mlflow): 88 vulnerabilities - [picklescan (PyPI)](https://junglewise.ai/threats/technologies/picklescan): 86 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "keystone (PyPI) vulnerabilities", https://junglewise.ai/threats/technologies/keystone, 13 November 2026.