CVE-2018-14432

In the Federation component of OpenStack Keystone before 11.0.4, 12.0.0, and 13.0.0, an authenticated "GET /v3/OS-FEDERATION/projects" request may bypass intended access restrictions on listing projects. An authenticated user may discover projects they have no authority to access, leaking all projects in the deployment and their attributes. Only Keystone with the /v3/OS-FEDERATION endpoint enabled via policy.json is affected.

• CWE-200

• http://www.openwall.com/lists/oss-security/2018/07/25/2Mailing List, Patch, Third Party Advisory
• http://www.securityfocus.com/bid/104930Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2018:2523Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2533Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2543Vendor Advisory
• https://www.debian.org/security/2018/dsa-4275Third Party Advisory
• http://www.openwall.com/lists/oss-security/2018/07/25/2Mailing List, Patch, Third Party Advisory
• http://www.securityfocus.com/bid/104930Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2018:2523Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2533Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2543Vendor Advisory
• https://www.debian.org/security/2018/dsa-4275Third Party Advisory

Published

Jul 31, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-14423Division-by-zero vulnerabilities in the functions pi_next_pc…
• CVE-2018-14424The daemon in GDM through 3.29.1 does not properly unexport …
• CVE-2018-14425There is a Persistent XSS vulnerability in the briefcase com…
• CVE-2018-14429man-cgi before 1.16 allows Local File Inclusion via absolute…
• CVE-2018-1443An XML parsing vulnerability affects IBM SAML-based single s…5.9
• CVE-2018-14430The Mondula Multi Step Form plugin through 1.2.5 for WordPre…
• CVE-2018-14434ImageMagick 7.0.8-4 has a memory leak for a colormap in Writ…
• CVE-2018-14435ImageMagick 7.0.8-4 has a memory leak in DecodeImage in code…
• CVE-2018-14436ImageMagick 7.0.8-4 has a memory leak in ReadMIFFImage in co…
• CVE-2018-14437ImageMagick 7.0.8-4 has a memory leak in parse8BIM in coders…
• CVE-2018-14438In Wireshark through 2.6.2, the create_app_running_mutex fun…
• CVE-2018-14439espritblock eos4j, an unofficial SDK for EOS, through 2018-0…