{"action":"Upgrade keystone to 16.0.1 or later.","affected":[{"fixed":"16.0.1","introduced":"0"}],"component":"keystone","cve_ids":["CVE-2019-19687"],"ecosystem":"PyPI","epss":0.0178,"exploited":false,"fixed_versions":["16.0.1"],"ghsa_id":"GHSA-2j23-fwqm-mgwr","id":"tcs_01M5KG97HPN84NA0Y38W059FP7","modified_at":"2026-06-10T17:01:58.389944091Z","published_at":"2019-12-09T18:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2019-29","https://review.opendev.org/#/c/697611/","https://review.opendev.org/#/c/697355/","https://review.opendev.org/#/c/697731/","https://bugs.launchpad.net/keystone/+bug/1855080","https://security.openstack.org/ossa/OSSA-2019-006.html","http://www.openwall.com/lists/oss-security/2019/12/11/8","https://access.redhat.com/errata/RHSA-2019:4358","https://usn.ubuntu.com/4262-1/","https://github.com/advisories/GHSA-2j23-fwqm-mgwr"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2019-29","url":"https://osv.dev/vulnerability/PYSEC-2019-29"}],"summary":"OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforc"}