OpenStack Identity Keystone is vulnerable to Block delegation escalation of privilege

published 2014-06-17 12 y ago modified 2026-07-06 4 mo ago also GHSA-274v-r947-v34r , PYSEC-2026-649 , EUVD-2022-1924

cvss: 6.0; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 2.3%; EPSS 2.3% chance of exploitation in 30 days, percentile 83%
public exploits: 0; none known

OpenStack Identity (Keystone) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 does not properly handle chained delegation, which allows remote authenticated users to gain privileges by leveraging a (1) trust or (2) OAuth token with impersonation enabled to create a new token with additional roles.

Patch / fix

fixed in 2 distros 3 links 1

pypi keystone 8.0.0a0
openstack keystone 2013.2.4, 2014.1.2

debian ubuntu red hat

keystone Debian 14, Debian 13, Debian 12 2014.1.1-2

debian advisories DEBIAN-CVE-2014-3476

keystone Ubuntu 14.04 LTS 1:2014.1.2.1-0ubuntu1

ubuntu advisories UBUNTU-CVE-2014-3476

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

openstack-keystone openstack 3 2013.1.5-3.el6ost
openstack-keystone openstack 4 2013.2.3-7.el6ost
python-keystone openstack 3 2013.1.5-3.el6ost
python-keystone openstack 4 2013.2.3-7.el6ost

red hat advisories RHSA-2014:0994

openwall.com/lists/oss-security/2014/06/12/3 advisory

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2014-3476 updated 2026-07-31 cvss 4.9

openstack-keystone: privilege escalation through trust chained delegation

Red Hat Enterprise Linux OpenStack Platform 5 (Icehouse) openstack-keystone
affected: no fix available
Red Hat Enterprise Linux OpenStack Platform 3.0 python-keystone 2013.1.5-3.el6ost, openstack-keystone 2013.1.5-3.el6ost Red Hat Enterprise Linux OpenStack Platform 4.0 python-keystone 2013.2.3-7.el6ost, openstack-keystone 2013.2.3-7.el6ost
fixed: vendor fix RHSA-2014:0994

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.33% chance of exploitation in the next 30 days, higher than 83% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

bugs.launchpad.net https://bugs.launchpad.net/keystone/+bug/1324592 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	2.0	6.0	AV:N/AC:M/Au:S/C:P/I:P/A:P

Affected packages

ecosystem	package	affected	fixed in
pypi	keystone	<8.0.0a0	8.0.0a0

Classification

Weakness

CWE-269 Improper Privilege Management

References

openwall.com /lists/oss-security/2014/06/12/3
mailing-list, web, patch, third-party-advisory
bugs.launchpad.net /keystone/+bug/1324592
web, exploit, issue-tracking, third-party-advisory
lists.opensuse.org /opensuse-security-announce/2014-06/msg00031.html
vendor-advisory, web, mailing-list, third-party-advisory
secunia.com /advisories/59547
third-party-advisory, web
securityfocus.com /bid/68026
vdb-entry, web, third-party-advisory
secunia.com /advisories/57886
third-party-advisory, web
nvd.nist.gov /vuln/detail/CVE-2014-3476
advisory
pypi.org /project/keystone
package
github.com /advisories/GHSA-274v-r947-v34r
advisory

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary