GHSA-jwpw-ppj5-7h4w CVE-2015-3646 PYSEC-2026-655

OpenStack Keystone Logs Passwords

Medium PyPI

Severity: Medium; The publisher's own rating, not a CVSS score
Exploit chance (EPSS): 2.88%; Chance of exploitation in the next 30 days. Higher than 86.85% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Fix: 2014.1.5; Upgrade keystone to this version or later

Description

OpenStack Identity (Keystone) before 2014.1.5 and 2014.2.x before 2014.2.4 logs the backend_argument configuration option content, which allows remote authenticated users to obtain passwords and other sensitive backend information by reading the Keystone logs.

Affected versions

PyPI

Package	Vulnerable	Fixed in
keystone	`>= 2011.3, < 2014.1.5`	`2014.1.5`
keystone	`>= 2014.2, < 2014.2.4`	`2014.2.4`
keystone	`>= 2011.3, < 2014.1.5` `>= 2014.2, < 2014.2.4`	`2014.1.5` `2014.2.4`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

keystone PyPI → `2014.1.5`

pip

pip install --upgrade "keystone>=2014.1.5"

poetry

poetry add "keystone>=2014.1.5"

uv

uv add "keystone>=2014.1.5"

Weakness

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

How to prevent it

Architecture and Design: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

References

Advisories

Packages

Timeline

May 13, 2022 Published
Jul 6, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-whqr-fgm5-x77q OpenStack Keystone's federated token rescoping mechanism doesn't propagate the original token's expiry to the newly issued token	High	Also affects keystone
GHSA-q623-f4j4-p4xj OpenStack Keystone has an Incorrect Authorization issue	High	Also affects keystone
GHSA-2r23-2g6v-2m5f OpenStack Keystone has an Authorization Bypass	High	Also affects keystone
GHSA-8f8m-wrvr-wcvf OpenStack Keystone doesn't verify that the user supplied in the authentication request matches the owner of the application credential	High	Also affects keystone
GHSA-hhq2-3832-xxcv OpenStack Keystone has an Incorrect Authorization Issue	High	Also affects keystone
GHSA-pfx2-9x9m-7ghx OpenStack Keystone: LDAP identity backend does not convert enabled attribute to boolean	High	Also affects keystone
GHSA-4phw-6824-6cfp OpenStack Keystone: Restricted application credentials can create EC2 credentials	Medium	Also affects keystone
GHSA-hcqg-5g63-7j9h OpenStack Keystone allows /v3/ec2tokens or /v3/s3tokens request with valid AWS Signature to provide Keystone authorization.	High	Also affects keystone

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor