CVE-2025-65073: OpenStack Keystone allows /v3/ec2tokens or /v3/s3tokens request with valid AWS Signature to provide Keystone authorization.

November 17, 2025 (updated November 18, 2025)

OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Signature to provide Keystone authorization.

References

github.com/advisories/GHSA-hcqg-5g63-7j9h
github.com/openstack/keystone
nvd.nist.gov/vuln/detail/CVE-2025-65073
www.openwall.com/lists/oss-security/2025/11/04/2

Code Behaviors & Features

Detect and mitigate CVE-2025-65073 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →