OpenStack Keystone allows /v3/ec2tokens or /v3/s3tokens request with valid AWS Signature to provide Keystone authorization.

published 2025-11-17 11 mo ago modified 2026-10-18 21 d ago also GHSA-hcqg-5g63-7j9h , PYSEC-2026-1490 , EUVD-2025-197772

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 15%
public exploits: 0; none known

OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Signature to provide Keystone authorization.

Patch / fix

fixed in 2 distros 3

pypi keystone 26.0.1, 27.0.0, 28.0.0
OpenStack Keystone 26.0.1

debian ubuntu red hat

keystone Debian 12 2:22.0.2-0+deb12u1
keystone Debian 13 2:27.0.0-3+deb13u1
keystone Debian 14 2:28.0.0-2

debian advisories DEBIAN-CVE-2025-65073

swift Ubuntu 22.04 LTS 2.29.2-0ubuntu1.1
swift Ubuntu 24.04 LTS 2.33.0-0ubuntu1.1
swift Ubuntu 25.10 2.36.0-0ubuntu1.1
keystone Ubuntu 22.04 LTS 2:21.0.1-0ubuntu2.1
keystone Ubuntu 24.04 LTS 2:25.0.0-0ubuntu1.1
keystone Ubuntu 25.10 2:28.0.0-0ubuntu1.1
keystone Ubuntu 26.04 LTS 2:28.0.0-0ubuntu2

ubuntu advisories UBUNTU-CVE-2025-65073

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

etcd openstack 16.2 3.3.23-22.el8ost
erlang openstack 16.2 23.3.4.18-2.el8ost
erlang-ssl openstack 16.2 23.3.4.18-2.el8ost
erlang-asn1 openstack 16.2 23.3.4.18-2.el8ost
erlang-erts openstack 16.2 23.3.4.18-2.el8ost
erlang-hipe openstack 16.2 23.3.4.18-2.el8ost
erlang-sasl openstack 16.2 23.3.4.18-2.el8ost
erlang-snmp openstack 16.2 23.3.4.18-2.el8ost

red hat advisories RHSA-2026:54757 RHSA-2026:28044 RHSA-2026:1958

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-65073 updated 2026-08-14 cvss 7.5

openstack-keystone: OpenStack Keystone: Unauthorized access and privilege escalation via AWS signature validation flaw

Red Hat OpenStack Platform 13 (Queens) rhosp13/openstack-keystone Red Hat OpenStack Platform 17.1 rhosp-rhel9/openstack-keystone Red Hat OpenStack Platform 18.0 rhoso/openstack-keystone-rhel9
affected: workaround, no fix available “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.”
Red Hat OpenStack Platform 16.2 python3-keystone 16.0.3-2.20260616134936.9d699a7.el8ost, openstack-keystone 16.0.3-2.20260616134936.9d699a7.el8ost
fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2026:54757
Red Hat OpenStack Platform 17.1 python3-swift 2.27.1-17.1.20231004180819.el9ost, openstack-swift 2.27.1-17.1.20231004180819.el9ost, openstack-swift-proxy 2.27.1-17.1.20231004180819.el9ost, openstack-swift-object 2.27.1-17.1.20231004180819.el9ost, openstack-swift-account 2.27.1-17.1.20231004180819.el9ost, openstack-swift-container 2.27.1-17.1.20231004180819.el9ost
fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2026:28044
Red Hat OpenStack Services on OpenShift 18.0 python3-keystone 23.0.3-18.0.20241202141842.9e3dfb4.el9ost, openstack-keystone 23.0.3-18.0.20241202141842.9e3dfb4.el9ost
fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2026:1958
Red Hat OpenStack Platform 16.2 etcd 3.3.23-22.el8ost, erlang 23.3.4.18-2.el8ost, python-pyasn1 0.4.6-4.el8ost, erlang-ssl 23.3.4.18-2.el8ost, python3-pyasn1 0.4.6-4.el8ost, erlang-asn1 23.3.4.18-2.el8ost, +79 more Red Hat OpenStack Platform 17.1 python3-tempest 33.0.0-17.1.20260406141650.1580f6f.el9ost, python3-keystone 19.0.2-17.1.20260529190847.54dd95d.el9ost, openstack-tempest 33.0.0-17.1.20260406141650.1580f6f.el9ost, openstack-keystone 19.0.2-17.1.20260529190847.54dd95d.el9ost, openstack-tempest-all 33.0.0-17.1.20260406141650.1580f6f.el9ost, python3-tempest-tests 33.0.0-17.1.20260406141650.1580f6f.el9ost
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 11 mo ago (2025-11-17)

Exploit prediction

0.24% chance of exploitation in the next 30 days, higher than 15% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
GitHub	3.1	7.5	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
OSV	3.1	7.5	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N

Affected packages

ecosystem	package	affected	fixed in
pypi	keystone	<26.0.1 >=27.0.0.0rc1, <27.0.0 >=28.0.0.0rc1, <28.0.0	26.0.1 27.0.0 28.0.0

Affected products

OpenStack Keystone

Classification

Weakness

CWE-863 Incorrect Authorization

References

openwall.com /lists/oss-security/2025/11/04/2
web
openwall.com /lists/oss-security/2025/11/17/6
web
nvd.nist.gov /vuln/detail/CVE-2025-65073
advisory
github.com /openstack/keystone
package
pypi.org /project/keystone
package
github.com /advisories/GHSA-hcqg-5g63-7j9h
advisory

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary