Live › vulnerability › CVE-2021-3563
Go to dashboardOpenStack Keystone, the identity service, verifies only the first 72 characters of an application secret. An attacker can therefore use a secret that matches the first 72 characters and gets past the password complexity rules administrators rely on.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 16:51 UTC, 0h before NVD. All times on this page are UTC.
Deployments running OpenStack Keystone up to and including 21.0.0 that use application secrets for authentication. Teams not running Keystone, or running a patched release, can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| keystone | pypi | <= 21.0.0 | – |
| openstack keystone | vendor | – | – |
| debian linux | vendor | = 10.0 | – |
| debian linux | vendor | = 11.0 | – |
| redhat openstack platform | vendor | = 10.0 | – |
| redhat openstack platform | vendor | = 13.0 | – |
| redhat openstack platform | vendor | = 16.1 | – |
| redhat openstack platform | vendor | = 16.2 | – |
pip show keystone and compare it to the affected range (<= 21.0.0).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in openstack-keystone, only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity which administrators may be counting on. The highest threat from this vulnerability is to data confidentiality and integrity. A patch is available.
This page as .md · .json · in your agent: get_signal("CVE-2021-3563")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.