CVE-2015-7546 json
OpenStack Identity Keystone and keystonemiddleware Insufficiently Protected Credentials
published 2016-02-03 10 y ago modified 2026-07-13 3 mo ago also GHSA-8c4w-v65p-jvcv , PYSEC-2016-20 , PYSEC-2026-2549 , EUVD-2016-0013
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.0%
- EPSS 2.0% chance of exploitation in 30 days, percentile 80%
- public exploits
- 0
- none known
Summary
The identity service in OpenStack Identity (Keystone) before 2015.1.3 (Kilo) and 8.0.x before 8.0.2 (Liberty) and keystonemiddleware (formerly python-keystoneclient) before 1.5.4 (Kilo) and Liberty before 2.3.3 does not properly invalidate authorization tokens when using the PKI or PKIZ token providers, which allows remote authenticated users to bypass intended access restrictions and gain access to cloud resources by manipulating byte fields within a revoked token.
Patch / fix
- pypi keystone 8.1.0, 9.0.0.0b2
- pypi keystonemiddleware 1.5.4, 2.3.3, 4.1.0
- openstack keystone 8.0.2
- keystone Debian 14, Debian 13, Debian 12 2:9.0.0~rc2-1
- python-keystonemiddleware Debian 14, Debian 13, Debian 12 3.0.0-1
debian advisories DEBIAN-CVE-2015-7546
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2015-7546 updated cvss 5.8
openstack-keystone: Improper check of tampered revocated PKI/PKIZ token
-
Red Hat Enterprise Linux OpenStack Platform 5 (Icehouse) openstack-keystone Red Hat Enterprise Linux OpenStack Platform 6 (Juno) openstack-keystone Red Hat Enterprise Linux OpenStack Platform 7 (Kilo) python-keystone, openstack-keystone Red Hat OpenStack Platform 8 (Liberty) python-keystone, openstack-keystoneaffected: no fix planned “Will not fix”
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
2.00% chance of exploitation in the next 30 days, higher than 80% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.0 | AV:N/AC:M/Au:S/C:P/I:P/A:P |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | keystone | >=9.0.0.0b1, <9.0.0.0b2 >=8.0, <8.1.0 |
9.0.0.0b2 8.1.0 |
| pypi | keystonemiddleware | >=2.4.0, <4.1.0 <1.5.4 >=1.6.0, <2.3.3 |
4.1.0 1.5.4 2.3.3 |
Classification
- Weakness
-
- CWE-522 Insufficiently Protected Credentials
References
-
security.openstack.org
/ossa/OSSA-2016-005.html
web, patch, vendor-advisory
-
github.com
/openstack/keystone/commit/bff03b5726fe5cac93d44a66715eea49b89c8cb0
web
-
github.com
/openstack/keystone/commit/d5378f173da14a34ca010271477337879002d6d0
web
-
github.com
/openstack/keystonemiddleware/commit/96ab58e6863c92575ada57615b19652e502adfd8
web
-
wiki.openstack.org
/wiki/OSSN/OSSN-0062
web, vendor-advisory
-
oracle.com
/technetwork/topics/security/bulletinapr2016-2952098.html
web, third-party-advisory
-
bugs.launchpad.net
/keystone/+bug/1490804
web, issue-tracking, third-party-advisory
-
securityfocus.com
/bid/80498
vdb-entry, third-party-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2015-7546
advisory
-
github.com
/pypa/advisory-database/tree/main/vulns/keystonemiddleware/PYSEC-2016-20.yaml
web
-
web.archive.org
/web/20200228002640/http://www.securityfocus.com/bid/80498
web
-
pypi.org
/project/keystone
package
-
github.com
/advisories/GHSA-8c4w-v65p-jvcv
advisory
Sources
- CVE List CVE-2015-7546
- GitHub Advisory GHSA-8c4w-v65p-jvcv
- NVD CVE-2015-7546
- OSV PYSEC-2026-2549
- OSV PYSEC-2016-20
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.