Medium
Security advisory
In the Federation component of OpenStack Keystone before 11.0.4, 12.0.0, and 13.0.0, an authenticated "GET /v3/OS-FEDERATION/projects" request may bypass intended access restrictions on listing projects. An authenticated user may discover projects they have no authority to access, leaking all projects in the deployment and their attributes. Only Keystone with the /v3/OS-FEDERATION endpoint enabled via policy.json is affected.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2018-14432
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 07:39 UTC · Revision 1
Source evidence
In the Federation component of OpenStack Keystone before 11.0.4, 12.0.0, and 13.0.0, an authenticated "GET /v3/OS-FEDERATION/projects" request may bypass intended access restrictions on listing projects. An authenticated user may discover projects they have no authority to access, leaking all projects in the deployment and their attributes. Only Keystone with the /v3/OS-FEDERATION endpoint enabled via policy.json is affected.
osv:CVE-2018-14432
Complete source record
{
"id": "004ac19fcc540c8f418979126c7f4d091b2d122b61cc011e4c803dfca625cf4c",
"url": "https://osv.dev/vulnerability/CVE-2018-14432",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2018-14432",
"summary": "In the Federation component of OpenStack Keystone before 11.0.4, 12.0.0, and 13.0.0, an authenticated \"GET /v3/OS-FEDERATION/projects\" request may bypass intended access restrictions on listing projects. An authenticated user may discover projects they have no authority to access, leaking all projects in the deployment and their attributes. Only Keystone with the /v3/OS-FEDERATION endpoint enabled via policy.json is affected.",
"evidence": "osv:CVE-2018-14432",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2018-14432",
"aliases": [
"CVE-2018-14432"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/openstack/keystone",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "ade177ad357d28746ab4203e56a74e6e1e89c074"
},
{
"introduced": "e2d33c2819b1f52e7ee651d06d0ed50fd54fad15"
},
{
"last_affected": "847676854572e0c36535048b731f966590adb746"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "11.0.4"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:openstack:keystone:12.0.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "12.0.0"
},
{
"last_affected": "12.0.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:openstack:keystone:13.0.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "13.0.0"
},
{
"last_affected": "13.0.0"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"12.0.0",
"13.0.0",
"13.0.0.0rc2",
"13.0.0.0rc1",
"13.0.0.0b3",
"13.0.0.0b2",
"13.0.0.0b1",
"12.0.0.0rc1",
"11.0.3",
"12.0.0.0b3",
"12.0.0.0b2",
"11.0.2",
"11.0.1",
"12.0.0.0b1",
"11.0.0.0rc1",
"11.0.0",
"11.0.0.0b3",
"11.0.0.0b2",
"11.0.0.0b1",
"10.0.0.0rc1",
"10.0.0.0b3",
"10.0.0.0b2",
"10.0.0.0b1",
"9.0.0.0rc1",
"9.0.0.0b3",
"9.0.0.0b2",
"9.0.0.0b1",
"8.0.0.0rc1",
"8.0.0.0b3",
"8.0.0.0b1",
"8.0.0.0b2",
"8.0.0a0",
"2015.1.0rc1",
"2015.1.0b3",
"2015.1.0b2",
"2015.1.0b1",
"2014.2.rc1",
"2014.2.b3",
"2014.2.b2",
"2014.2.b1",
"2014.1.rc1",
"2014.1.b3",
"2014.1.b2",
"2014.1.b1",
"2013.2.rc1",
"2013.2.b3",
"2013.2.b1",
"grizzly-2",
"grizzly-1",
"folsom-rc1",
"folsom-2",
"folsom-1",
"essex-rc1",
"essex-4",
"2011.3"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-14432.json"
}
}
],
"modified": "2026-10-24T10:30:56.351145410Z",
"provider": "osv",
"references": [
"https://access.redhat.com/errata/RHSA-2018:2523",
"https://access.redhat.com/errata/RHSA-2018:2533",
"https://access.redhat.com/errata/RHSA-2018:2543",
"https://www.debian.org/security/2018/dsa-4275"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "9.0"
},
{
"last_affected": "9.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:*",
"cpe:2.3:a:redhat:openstack:12:*:*:*:*:*:*:*",
"cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:*"
],
"vendor_product": "redhat:openstack",
"extracted_events": [
{
"range": [
{
"introduced": "10"
},
{
"last_affected": "10"
},
{
"introduced": "12"
},
{
"last_affected": "12"
},
{
"introduced": "13"
},
{
"last_affected": "13"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2018-14432",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 438651,
"published_at": "2018-07-31T14:29:00.713+00:00"
}