CVE-2025-65073
Fixed in a distro release EPSS <1%CVSS 7.5
OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Signature to provide Keystone authorization.
Products: OpenStack Keystone
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | keystone | 26.0.1 |
| PyPI | keystone | 27.0.0 |
| PyPI | keystone | 28.0.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 11 | keystone | 2:18.1.0-1+deb11u2 |
| Debian 12 | keystone | 2:22.0.2-0+deb12u1 |
| Debian 13 | keystone | 2:27.0.0-3+deb13u1 |
| Debian 14 | keystone | 2:28.0.0-2 |
| Red Hat openstack 16.2 | collectd-sensubility | 0:0.2.1-1.1.el8ost |
| Red Hat openstack 16.2 | collectd-sensubility-debuginfo | 0:0.2.1-1.1.el8ost |
| Red Hat openstack 16.2 | erlang | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-asn1 | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-asn1-debuginfo | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-compiler | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-crypto | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-crypto-debuginfo | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-debuginfo | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-debugsource | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-eldap | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-erl_interface-debuginfo | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-erts | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-erts-debuginfo | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-hipe | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-inets | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-kernel | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-mnesia | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-odbc-debuginfo | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-os_mon | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-os_mon-debuginfo | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-parsetools | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-public_key | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-runtime_tools | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-runtime_tools-debuginfo | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-sasl | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-snmp | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-ssl | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-stdlib | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-syntax_tools | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-tools | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-tools-debuginfo | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-xmerl | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | etcd | 0:3.3.23-22.el8ost |
| Red Hat openstack 16.2 | etcd-debuginfo | 0:3.3.23-22.el8ost |
| Red Hat openstack 16.2 | etcd-debugsource | 0:3.3.23-22.el8ost |
| Red Hat openstack 16.2 | openstack-glance | 1:19.0.5-2.20260512165254.eb6ad61.el8ost |
| Red Hat openstack 16.2 | openstack-keystone | 1:16.0.3-2.20260616134936.9d699a7.el8ost |
| Red Hat openstack 16.2 | openstack-nova | 1:20.6.2-2.20260317135026.8a24acd.el8ost |
| Red Hat openstack 16.2 | openstack-nova-api | 1:20.6.2-2.20260317135026.8a24acd.el8ost |
| Red Hat openstack 16.2 | openstack-nova-common | 1:20.6.2-2.20260317135026.8a24acd.el8ost |
| Red Hat openstack 16.2 | openstack-nova-compute | 1:20.6.2-2.20260317135026.8a24acd.el8ost |
| Red Hat openstack 16.2 | openstack-nova-conductor | 1:20.6.2-2.20260317135026.8a24acd.el8ost |
| Red Hat openstack 16.2 | openstack-nova-console | 1:20.6.2-2.20260317135026.8a24acd.el8ost |
| Red Hat openstack 16.2 | openstack-nova-migration | 1:20.6.2-2.20260317135026.8a24acd.el8ost |
| Red Hat openstack 16.2 | openstack-nova-novncproxy | 1:20.6.2-2.20260317135026.8a24acd.el8ost |
| Red Hat openstack 16.2 | openstack-nova-scheduler | 1:20.6.2-2.20260317135026.8a24acd.el8ost |
| Red Hat openstack 16.2 | openstack-nova-serialproxy | 1:20.6.2-2.20260317135026.8a24acd.el8ost |
| Red Hat openstack 16.2 | openstack-nova-spicehtml5proxy | 1:20.6.2-2.20260317135026.8a24acd.el8ost |
| Red Hat openstack 16.2 | python-oslo-messaging | 0:10.2.4-2.20260710155333.82281a0.el8ost |
| Red Hat openstack 16.2 | python-pyasn1 | 0:0.4.6-4.el8ost |
| Red Hat openstack 16.2 | python3-glance | 1:19.0.5-2.20260512165254.eb6ad61.el8ost |
| Red Hat openstack 16.2 | python3-keystone | 1:16.0.3-2.20260616134936.9d699a7.el8ost |
| Red Hat openstack 16.2 | python3-nova | 1:20.6.2-2.20260317135026.8a24acd.el8ost |
| Red Hat openstack 16.2 | python3-oslo-messaging | 0:10.2.4-2.20260710155333.82281a0.el8ost |
| Red Hat openstack 16.2 | python3-pyasn1 | 0:0.4.6-4.el8ost |
| Red Hat openstack 16.2 | python3-pyasn1-modules | 0:0.4.6-4.el8ost |
| Red Hat openstack 17.1 | openstack-keystone | 1:19.0.2-17.1.20260529190847.54dd95d.el9ost |
| Red Hat openstack 17.1 | openstack-swift | 0:2.27.1-17.1.20231004180819.el9ost |
| Red Hat openstack 17.1 | openstack-swift-account | 0:2.27.1-17.1.20231004180819.el9ost |
| Red Hat openstack 17.1 | openstack-swift-container | 0:2.27.1-17.1.20231004180819.el9ost |
| Red Hat openstack 17.1 | openstack-swift-object | 0:2.27.1-17.1.20231004180819.el9ost |
| Red Hat openstack 17.1 | openstack-swift-proxy | 0:2.27.1-17.1.20231004180819.el9ost |
| Red Hat openstack 17.1 | openstack-tempest | 1:33.0.0-17.1.20260406141650.1580f6f.el9ost |
| Red Hat openstack 17.1 | openstack-tempest-all | 1:33.0.0-17.1.20260406141650.1580f6f.el9ost |
| Red Hat openstack 17.1 | python3-keystone | 1:19.0.2-17.1.20260529190847.54dd95d.el9ost |
| Red Hat openstack 17.1 | python3-swift | 0:2.27.1-17.1.20231004180819.el9ost |
| Red Hat openstack 17.1 | python3-tempest | 1:33.0.0-17.1.20260406141650.1580f6f.el9ost |
| Red Hat openstack 17.1 | python3-tempest-tests | 1:33.0.0-17.1.20260406141650.1580f6f.el9ost |
| Red Hat openstack 18.0 | openstack-keystone | 1:23.0.3-18.0.20241202141842.9e3dfb4.el9ost |
| Red Hat openstack 18.0 | python3-keystone | 1:23.0.3-18.0.20241202141842.9e3dfb4.el9ost |
| Ubuntu 16.04 LTS | heat | no fix |
| Ubuntu 16.04 LTS | swift | no fix |
| Ubuntu 18.04 LTS | heat | no fix |
| Ubuntu 18.04 LTS | swift | no fix |
| Ubuntu 20.04 LTS | heat | no fix |
| Ubuntu 20.04 LTS | swift | no fix |
| Ubuntu 22.04 LTS | heat | no fix |
| Ubuntu 22.04 LTS | keystone | 2:21.0.1-0ubuntu2.1 |
| Ubuntu 22.04 LTS | swift | 2.29.2-0ubuntu1.1 |
| Ubuntu 24.04 LTS | heat | no fix |
| Ubuntu 24.04 LTS | keystone | 2:25.0.0-0ubuntu1.1 |
| Ubuntu 24.04 LTS | swift | 2.33.0-0ubuntu1.1 |
| Ubuntu 25.10 | heat | no fix |
| Ubuntu 25.10 | keystone | 2:28.0.0-0ubuntu1.1 |
| Ubuntu 25.10 | swift | 2.36.0-0ubuntu1.1 |
| Ubuntu 26.04 LTS | heat | no fix |
| Ubuntu 26.04 LTS | keystone | 2:28.0.0-0ubuntu2 |
| Ubuntu 26.10 | heat | no fix |
| Ubuntu Pro 16.04 LTS | keystone | no fix |
| Ubuntu Pro 18.04 LTS | keystone | no fix |
| Ubuntu Pro 20.04 LTS | keystone | no fix |