{"action":"Upgrade keystone to 16.0.2 or later.","affected":[{"fixed":"16.0.2","introduced":"10.0"},{"fixed":"17.0.1","introduced":"17.0"},{"fixed":"18.0.1","introduced":"18.0"},{"fixed":"19.0.1","introduced":"19.0"}],"component":"keystone","cve_ids":["CVE-2021-38155"],"ecosystem":"PyPI","epss":0.02478,"exploited":false,"fixed_versions":["16.0.2","17.0.1","18.0.1","19.0.1"],"ghsa_id":"GHSA-4225-97pr-rr52","id":"tcs_01M5KHDTJA6N012ZPEWR5FPQJ3","modified_at":"2026-07-07T11:45:41.977390817Z","published_at":"2026-07-06T08:03:28.999306Z","references":["https://osv.dev/vulnerability/PYSEC-2026-830","https://nvd.nist.gov/vuln/detail/CVE-2021-38155","https://github.com/openstack/keystone/commit/1b573ae7d1c20e0ebfbde79bbe7538a09589c75d","https://github.com/openstack/keystone/commit/8ab4eb27be4c13c9bab2b3ea700f00a190521bf8","https://github.com/openstack/keystone/commit/ac2631ae33445877094cdae796fbcdce8833a626","https://github.com/openstack/keystone","https://launchpad.net/bugs/1688137","https://lists.debian.org/debian-lts-announce/2024/01/msg00007.html","https://security.openstack.org/ossa/OSSA-2021-003.html","http://www.openwall.com/lists/oss-security/2021/08/10/5","https://pypi.org/project/keystone","https://github.com/advisories/GHSA-4225-97pr-rr52"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"PYSEC-2026-830","url":"https://osv.dev/vulnerability/PYSEC-2026-830"}],"summary":"OpenStack Keystone allows information disclosure during account locking"}