CVE-2014-3476: OpenStack Identity (Keystone) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 does not prop...

Security readout for executives and security teams

This flaw affected OpenStack Keystone, the identity service for OpenStack clouds. An authenticated user could abuse delegated access paths to obtain a token with roles they should not have. That makes it a cloud-control-plane privilege escalation, especially serious where Keystone governs tenant, project, or administrative access. Exposure is likely limited to older OpenStack environments running the affected Keystone versions, especially deployments using trusts, OAuth delegation, or impersonation. Current exposure cannot be assumed from the bundle; asset owners must verify installed Keystone package versions and branch lineage. Prioritize remediation for any production OpenStack cloud still running affected Keystone versions. The issue targets identity and authorization, so successful abuse could undermine tenant isolation or administrative boundaries, even though the bundle does not show active exploitation. Mitigation focus: Upgrade Keystone to 2013.2.4, 2014.1.2, Juno-2, or later fixed vendor builds.; Apply distribution advisories such as SUSE-SU-2014:0848 where applicable.; Review vendor guidance for supported backported fixes on packaged OpenStack deployments..

Prepared

Jun 14, 2026, 14:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.