CVE-2012-4456
OpenStack Keystone Improper Authentication vulnerability
The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary user or get, create, or delete arbitrary services.
Exploit likelihood
What each source reports
NVD Score used
The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary user or get, create, or delete arbitrary services.
- Record
CVE-2012-4456- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE List No score
The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary user or get, create, or delete arbitrary services.
- Record
CVE-2012-4456- Updated
- 2026-11-02
EUVDEUVD-2022-4547 No score
The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary user or get, create, or delete arbitrary services.
- Record
EUVD-2022-4547- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mf98-r2gf-2x3w No score
OpenStack Keystone Improper Authentication vulnerability
The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary user or get, create, or delete arbitrary services.
- Record
GHSA-mf98-r2gf-2x3w- Weakness
- CWE-287
- Updated
- 2026-11-02
OSV No score
The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary user or get, create, or delete arbitrary services.
- Record
CVE-2012-4456- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-4456 No score
The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary user or get, create, or delete arbitrary services.
- Record
DEBIAN-CVE-2012-4456- Updated
- 2026-11-02
OSVGHSA-mf98-r2gf-2x3w No score
OpenStack Keystone Improper Authentication vulnerability
The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary user or get, create, or delete arbitrary services.
- Record
GHSA-mf98-r2gf-2x3w- Weakness
- CWE-287
- Updated
- 2026-11-02
OSVPYSEC-2026-832 No score
OpenStack Keystone Improper Authentication vulnerability
The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary user or get, create, or delete arbitrary services.
- Record
PYSEC-2026-832- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
keystonePyPI |
2012.1 up to 2012.1.2 | 2012.1.2 |
keystoneDebian:12 |
before 2012.1.1-9 | 2012.1.1-9 |
keystoneDebian:13 |
before 2012.1.1-9 | 2012.1.1-9 |
keystoneDebian:14 |
before 2012.1.1-9 | 2012.1.1-9 |
openstack-keystoneRed Hat:openstack:1::el6 |
before 0:2012.1.2-4.el6 | 0:2012.1.2-4.el6 |
openstack-keystone-docRed Hat:openstack:1::el6 |
before 0:2012.1.2-4.el6 | 0:2012.1.2-4.el6 |
python-keystoneRed Hat:openstack:1::el6 |
before 0:2012.1.2-4.el6 | 0:2012.1.2-4.el6 |
python-keystone-auth-tokenRed Hat:openstack:1::el6 |
before 0:2012.1.2-4.el6 | 0:2012.1.2-4.el6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-4456 is a high vulnerability (CVSS 7.5) in Openstack Keystone, published October 9, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.00%, the 90th percentile. Fixed in keystone 2012.1.2.
References
openwall.com/lists/oss-security/2012/09/28/5
secunia.com/advisories/50665
lists.launchpad.net/openstack/msg17034.html
github.com/openstack/keystone/commit/24df3adb3f50cbb5ada411bc67aba8a781e6a431
bugs.launchpad.net/keystone/+bug/1006822
Show 29 moreShow less
securityfocus.com/bid/55716
exchange.xforce.ibmcloud.com/vulnerabilities/78944
bugzilla.redhat.com/show_bug.cgi?id=861179
nvd.nist.gov/vuln/detail/CVE-2012-4456
access.redhat.com/errata/RHSA-2012:1378
web.archive.org/web/20121114024512/http://www.securityfocus.com/bid/55716
security-tracker.debian.org/tracker/CVE-2012-4456
pypi.org/project/keystone
security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_1378.json
cve.org/CVERecord?id=CVE-2012-3542