CVE catalog

CVE-2020-12690

keystone affected and fixed versions

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access.

Severity: High · CVSS 8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published: May 6, 2020, 3:00:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 1.90% · Oct 27, 2026

Projects and upstream resources

[keystone][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiantrixie-security	keystone	`2:27.0.0-3+deb13u6`	Fixed	[CVE-2020-12690]
Debiantrixie	keystone	`2:17.0.0~rc2-1`	FixedDistribution-reported fixed boundary	[CVE-2020-12690]
Debiantrixie	keystone	`2:27.0.0-3+deb13u5`	Fixed	[CVE-2020-12690]
Debiansid	keystone	`2:17.0.0~rc2-1`	FixedDistribution-reported fixed boundary	[CVE-2020-12690]
Debiansid	keystone	`2:30.0.0-3`	Fixed	[CVE-2020-12690]
Debianforky	keystone	`2:17.0.0~rc2-1`	FixedDistribution-reported fixed boundary	[CVE-2020-12690]
Debianforky	keystone	`2:30.0.0-3`	Fixed	[CVE-2020-12690]
Debianbookworm-security	keystone	`2:22.0.2-0+deb12u6`	Fixed	[CVE-2020-12690]
Debianbookworm	keystone	`2:17.0.0~rc2-1`	FixedDistribution-reported fixed boundary	[CVE-2020-12690]
Debianbookworm	keystone	`2:22.0.2-0+deb12u3`	Fixed	[CVE-2020-12690]

Showing 10 fix observations. All 37 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
Debianbookworm	keystone	`2:17.0.0~rc2-1`	FixedDistribution-reported fixed boundary	[CVE-2020-12690]
Debianbookworm	keystone	`2:22.0.2-0+deb12u3`	Fixed	[CVE-2020-12690]
Debianbookworm-security	keystone	`2:22.0.2-0+deb12u6`	Fixed	[CVE-2020-12690]
Debianforky	keystone	`2:17.0.0~rc2-1`	FixedDistribution-reported fixed boundary	[CVE-2020-12690]
Debianforky	keystone	`2:30.0.0-3`	Fixed	[CVE-2020-12690]
Debiansid	keystone	`2:17.0.0~rc2-1`	FixedDistribution-reported fixed boundary	[CVE-2020-12690]
Debiansid	keystone	`2:30.0.0-3`	Fixed	[CVE-2020-12690]
Debiantrixie	keystone	`2:17.0.0~rc2-1`	FixedDistribution-reported fixed boundary	[CVE-2020-12690]
Debiantrixie	keystone	`2:27.0.0-3+deb13u5`	Fixed	[CVE-2020-12690]
Debiantrixie-security	keystone	`2:27.0.0-3+deb13u6`	Fixed	[CVE-2020-12690]
Ubuntu18.04	keystone	`2:12.0.0-0ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-12690]Sep 30, 2026, 6:21:20 PM UTC
Ubuntu18.04	keystone	`2:13.0.0-0ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-12690]Sep 30, 2026, 6:21:20 PM UTC
Ubuntu18.04	keystone	`2:13.0.0~b1-0ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-12690]Sep 30, 2026, 6:21:20 PM UTC
Ubuntu18.04	keystone	`2:13.0.0~b2-0ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-12690]Sep 30, 2026, 6:21:20 PM UTC
Ubuntu18.04	keystone	`2:13.0.0~b3-0ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-12690]Sep 30, 2026, 6:21:20 PM UTC
Ubuntu18.04	keystone	`2:13.0.0~rc1-0ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-12690]Sep 30, 2026, 6:21:20 PM UTC
Ubuntu18.04	keystone	`2:13.0.0~rc2-0ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-12690]Sep 30, 2026, 6:21:20 PM UTC
Ubuntu18.04	keystone	`2:13.0.1-0ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-12690]Sep 30, 2026, 6:21:20 PM UTC
Ubuntu18.04	keystone	`2:13.0.2-0ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-12690]Sep 30, 2026, 6:21:20 PM UTC
Ubuntu18.04	keystone	`2:13.0.2-0ubuntu3`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-12690]Sep 30, 2026, 6:21:20 PM UTC
Ubuntu18.04	keystone	`2:13.0.4-0ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-12690]Sep 30, 2026, 6:21:20 PM UTC
Ubuntupro	keystone	`2:8.0.0-0ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-12690]Sep 30, 2026, 6:21:20 PM UTC
Ubuntupro	keystone	`2:9.0.0-0ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-12690]Sep 30, 2026, 6:21:20 PM UTC
Ubuntupro	keystone	`2:9.0.0~b1-0ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-12690]Sep 30, 2026, 6:21:20 PM UTC
Ubuntupro	keystone	`2:9.0.0~b2-0ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-12690]Sep 30, 2026, 6:21:20 PM UTC
Ubuntupro	keystone	`2:9.0.0~b3-0ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-12690]Sep 30, 2026, 6:21:20 PM UTC
Ubuntupro	keystone	`2:9.0.0~rc1-0ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-12690]Sep 30, 2026, 6:21:20 PM UTC
Ubuntupro	keystone	`2:9.0.2-0ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-12690]Sep 30, 2026, 6:21:20 PM UTC
Ubuntupro	keystone	`2:9.0.2-0ubuntu2`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-12690]Sep 30, 2026, 6:21:20 PM UTC
Ubuntupro	keystone	`2:9.1.0-0ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-12690]Sep 30, 2026, 6:21:20 PM UTC
Ubuntupro	keystone	`2:9.2.0-0ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-12690]Sep 30, 2026, 6:21:20 PM UTC
Ubuntupro	keystone	`2:9.3.0-0ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-12690]Sep 30, 2026, 6:21:20 PM UTC
Ubuntupro	keystone	`2:9.3.0-0ubuntu2`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-12690]Sep 30, 2026, 6:21:20 PM UTC
Ubuntupro	keystone	`2:9.3.0-0ubuntu3`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-12690]Sep 30, 2026, 6:21:20 PM UTC
Ubuntupro	keystone	`2:9.3.0-0ubuntu3.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-12690]Sep 30, 2026, 6:21:20 PM UTC
Ubuntupro	keystone	`2:9.3.0-0ubuntu3.2`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-12690]Sep 30, 2026, 6:21:20 PM UTC
Ubuntupro	keystone	`2:9.3.0-0ubuntu3.2+esm2`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-12690]Sep 30, 2026, 6:21:20 PM UTC

Original provider fields

{
  "package_releases": [
    {
      "name": "keystone",
      "status": "fixed",
      "release": "sid",
      "version": "2:30.0.0-3"
    },
    {
      "name": "keystone",
      "status": "fixed",
      "release": "forky",
      "version": "2:30.0.0-3"
    },
    {
      "name": "keystone",
      "status": "fixed",
      "release": "trixie",
      "version": "2:27.0.0-3+deb13u5"
    },
    {
      "name": "keystone",
      "status": "fixed",
      "release": "trixie-security",
      "version": "2:27.0.0-3+deb13u6"
    },
    {
      "name": "keystone",
      "status": "fixed",
      "release": "bookworm",
      "version": "2:22.0.2-0+deb12u3"
    },
    {
      "name": "keystone",
      "status": "fixed",
      "release": "bookworm-security",
      "version": "2:22.0.2-0+deb12u6"
    }
  ],
  "fixed_versions": [
    {
      "bug": 959900,
      "name": "keystone",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "2:17.0.0~rc2-1"
    },
    {
      "bug": 959900,
      "name": "keystone",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "2:17.0.0~rc2-1"
    },
    {
      "bug": 959900,
      "name": "keystone",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "2:17.0.0~rc2-1"
    },
    {
      "bug": 959900,
      "name": "keystone",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "2:17.0.0~rc2-1"
    }
  ],
  "distribution_packages": [
    {
      "name": "keystone",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "2:8.0.0-0ubuntu1",
        "2:9.0.0~b1-0ubuntu1",
        "2:9.0.0~b2-0ubuntu1",
        "2:9.0.0~b3-0ubuntu1",
        "2:9.0.0~rc1-0ubuntu1",
        "2:9.0.0-0ubuntu1",
        "2:9.0.2-0ubuntu1",
        "2:9.0.2-0ubuntu2",
        "2:9.1.0-0ubuntu1",
        "2:9.2.0-0ubuntu1",
        "2:9.3.0-0ubuntu1",
        "2:9.3.0-0ubuntu2",
        "2:9.3.0-0ubuntu3",
        "2:9.3.0-0ubuntu3.1",
        "2:9.3.0-0ubuntu3.2",
        "2:9.3.0-0ubuntu3.2+esm2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2020-12690",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2020-12690",
      "provider_updated_at": "2026-09-30T18:21:20.210841453Z",
      "applicability_unknown": true
    },
    {
      "name": "keystone",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2:13.0.4-0ubuntu1"
            }
          ]
        }
      ],
      "release": "18.04",
      "versions": [
        "2:12.0.0-0ubuntu1",
        "2:13.0.0~b1-0ubuntu1",
        "2:13.0.0~b2-0ubuntu1",
        "2:13.0.0~b3-0ubuntu1",
        "2:13.0.0~rc1-0ubuntu1",
        "2:13.0.0~rc2-0ubuntu1",
        "2:13.0.0-0ubuntu1",
        "2:13.0.1-0ubuntu1",
        "2:13.0.2-0ubuntu1",
        "2:13.0.2-0ubuntu3"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2020-12690",
      "fixed_version": "2:13.0.4-0ubuntu1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2020-12690",
      "provider_updated_at": "2026-09-30T18:21:20.210841453Z",
      "applicability_unknown": true
    }
  ]
}

[Debian bug #959900]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[keystone]Unknown
Details (4)
- 2:22.0.2-0+deb12u3 · all · bookworm
  Fixed · Fixed: 2:17.0.0~rc2-1
  dsa · keystone · debian · bookworm; dsa · keystone · debian · 12
- 2:22.0.2-0+deb12u3 · all · bookworm
  Fixed · Fixed: 2:17.0.0~rc2-1
  dsa · keystone · debian · bookworm; dsa · keystone · debian · 12
- 2:22.0.2-0+deb12u3 · all · bookworm-security
  Fixed · Fixed: 2:17.0.0~rc2-1
  dsa · keystone · debian · bookworm; dsa · keystone · debian · 12
- 2:22.0.2-0+deb12u3 · all · bookworm-security
  Fixed · Fixed: 2:17.0.0~rc2-1
  dsa · keystone · debian · bookworm; dsa · keystone · debian · 12
[keystone-doc]Unknown
Source package: [keystone]
Details (4)
- 2:22.0.2-0+deb12u3 · all · bookworm
  Fixed · Fixed: 2:17.0.0~rc2-1
  dsa · keystone · debian · bookworm; dsa · keystone · debian · 12
- 2:22.0.2-0+deb12u3 · all · bookworm
  Fixed · Fixed: 2:17.0.0~rc2-1
  dsa · keystone · debian · bookworm; dsa · keystone · debian · 12
- 2:22.0.2-0+deb12u3 · all · bookworm-security
  Fixed · Fixed: 2:17.0.0~rc2-1
  dsa · keystone · debian · bookworm; dsa · keystone · debian · 12
- 2:22.0.2-0+deb12u3 · all · bookworm-security
  Fixed · Fixed: 2:17.0.0~rc2-1
  dsa · keystone · debian · bookworm; dsa · keystone · debian · 12
[python3-keystone]Unknown
Source package: [keystone]
Details (4)
- 2:22.0.2-0+deb12u3 · all · bookworm
  Fixed · Fixed: 2:17.0.0~rc2-1
  dsa · keystone · debian · bookworm; dsa · keystone · debian · 12
- 2:22.0.2-0+deb12u3 · all · bookworm
  Fixed · Fixed: 2:17.0.0~rc2-1
  dsa · keystone · debian · bookworm; dsa · keystone · debian · 12
- 2:22.0.2-0+deb12u3 · all · bookworm-security
  Fixed · Fixed: 2:17.0.0~rc2-1
  dsa · keystone · debian · bookworm; dsa · keystone · debian · 12
- 2:22.0.2-0+deb12u3 · all · bookworm-security
  Fixed · Fixed: 2:17.0.0~rc2-1
  dsa · keystone · debian · bookworm; dsa · keystone · debian · 12

[Debian 13 (Trixie)]

[keystone]Unknown
Details (6)
- 2:27.0.0-3+deb13u4 · all · trixie
  Fixed · Fixed: 2:17.0.0~rc2-1
  dsa · keystone · debian · 13
- 2:27.0.0-3+deb13u4 · all · trixie
  Fixed · Fixed: 2:17.0.0~rc2-1
  dsa · keystone · debian · 13
- 2:27.0.0-3+deb13u4 · all · trixie-security
  Fixed · Fixed: 2:17.0.0~rc2-1
  dsa · keystone · debian · 13
- 2:27.0.0-3+deb13u4 · all · trixie-security · Historical version
  Fixed · Fixed: 2:17.0.0~rc2-1
  dsa · keystone · debian · 13
- 2:27.0.0-3+deb13u5 · all · trixie-security · Historical version
  Fixed · Fixed: 2:17.0.0~rc2-1
  dsa · keystone · debian · 13
- 2:27.0.0-3+deb13u6 · all · trixie-security
  Fixed · Fixed: 2:17.0.0~rc2-1
  dsa · keystone · debian · 13
[keystone-doc]Unknown
Source package: [keystone]
Details (6)
- 2:27.0.0-3+deb13u4 · all · trixie
  Fixed · Fixed: 2:17.0.0~rc2-1
  dsa · keystone · debian · 13
- 2:27.0.0-3+deb13u4 · all · trixie
  Fixed · Fixed: 2:17.0.0~rc2-1
  dsa · keystone · debian · 13
- 2:27.0.0-3+deb13u4 · all · trixie-security
  Fixed · Fixed: 2:17.0.0~rc2-1
  dsa · keystone · debian · 13
- 2:27.0.0-3+deb13u4 · all · trixie-security · Historical version
  Fixed · Fixed: 2:17.0.0~rc2-1
  dsa · keystone · debian · 13
- 2:27.0.0-3+deb13u5 · all · trixie-security · Historical version
  Fixed · Fixed: 2:17.0.0~rc2-1
  dsa · keystone · debian · 13
- 2:27.0.0-3+deb13u6 · all · trixie-security
  Fixed · Fixed: 2:17.0.0~rc2-1
  dsa · keystone · debian · 13
[python3-keystone]Unknown
Source package: [keystone]
Details (6)
- 2:27.0.0-3+deb13u4 · all · trixie
  Fixed · Fixed: 2:17.0.0~rc2-1
  dsa · keystone · debian · 13
- 2:27.0.0-3+deb13u4 · all · trixie
  Fixed · Fixed: 2:17.0.0~rc2-1
  dsa · keystone · debian · 13
- 2:27.0.0-3+deb13u4 · all · trixie-security
  Fixed · Fixed: 2:17.0.0~rc2-1
  dsa · keystone · debian · 13
- 2:27.0.0-3+deb13u4 · all · trixie-security · Historical version
  Fixed · Fixed: 2:17.0.0~rc2-1
  dsa · keystone · debian · 13
- 2:27.0.0-3+deb13u5 · all · trixie-security · Historical version
  Fixed · Fixed: 2:17.0.0~rc2-1
  dsa · keystone · debian · 13
- 2:27.0.0-3+deb13u6 · all · trixie-security
  Fixed · Fixed: 2:17.0.0~rc2-1
  dsa · keystone · debian · 13

Observed: Oct 23, 2026, 5:47:28 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]