CVE-2021-38155: OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before...

Security readout for executives and security teams

Keystone could reveal whether an account name exists and expose that account’s UUID during repeated failed login attempts. This affects OpenStack deployments that enabled the PCI DSS-related account lockout setting. The issue is information disclosure, not direct account takeover, but it can support later targeting. Exposure is limited to OpenStack Keystone deployments running affected versions and enabling security_compliance.lockout_failure_attempts. Publicly reachable Keystone authentication endpoints increase practical risk. The bundle does not identify other affected products. Treat this as a targeted information disclosure risk for OpenStack environments, especially internet-exposed identity services. Prioritize patching where account lockout is enabled or where Keystone is reachable by untrusted users. Mitigation focus: Upgrade Keystone to fixed releases: 16.0.2, 17.0.1, 18.0.1, or 19.0.1 as applicable.; Apply downstream security updates where Keystone is packaged by a distribution, such as Debian LTS guidance.; Check OpenStack vendor guidance before changing lockout configuration as a temporary risk decision..

Prepared

Jun 2, 2026, 19:01 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.