CVE-2012-5571
Openstack keystone: openstack keystone: authorization bypass via improper ec2 token handling
CVE-2012-5571 is a medium vulnerability (CVSS 5.4) in Openstack Essex, published December 18, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.05%, the 81st percentile. Fixed in keystone 8.0.0a0.
- Severity
- 5.4 MediumCVSS 3.1, CVE List
- Exploit chance
- 2.05%EPSS, 81st percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
8.0.0a0keystone +10 more
Description
A flaw was found in OpenStack Keystone. This vulnerability allows remote authenticated users to bypass intended authorization restrictions. This occurs because OpenStack Keystone does not properly handle EC2 (Elastic Compute Cloud) tokens when a user's role has been removed from a tenant. An attacker can leverage a token associated with a removed user role to gain unauthorized access.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
keystonePyPI | before 8.0.0a0 | 8.0.0a0 |
keystoneDebian:12 | before 2012.1.1-11 | 2012.1.1-11 |
keystoneDebian:13 | before 2012.1.1-11 | 2012.1.1-11 |
keystoneDebian:14 | before 2012.1.1-11 | 2012.1.1-11 |
openstack-keystoneRed Hat:openstack:1::el6 From an advisory covering 2 CVEs | before 0:2012.1.3-3.el6 | 0:2012.1.3-3.el6 |
openstack-keystone-docRed Hat:openstack:1::el6 From an advisory covering 2 CVEs | before 0:2012.1.3-3.el6 | 0:2012.1.3-3.el6 |
python-keystoneRed Hat:openstack:1::el6 From an advisory covering 2 CVEs | before 0:2012.1.3-3.el6 | 0:2012.1.3-3.el6 |
python-keystone-auth-tokenRed Hat:openstack:1::el6 From an advisory covering 2 CVEs | before 0:2012.1.3-3.el6 | 0:2012.1.3-3.el6 |
openstack-keystoneRed Hat:openstack:2::el6 From an advisory covering 2 CVEs | before 0:2012.2.1-1.el6ost | 0:2012.2.1-1.el6ost |
openstack-keystone-docRed Hat:openstack:2::el6 From an advisory covering 2 CVEs | before 0:2012.2.1-1.el6ost | 0:2012.2.1-1.el6ost |
python-keystoneRed Hat:openstack:2::el6 From an advisory covering 2 CVEs | before 0:2012.2.1-1.el6ost | 0:2012.2.1-1.el6ost |
What each source reports
CVE List Score used
Openstack keystone: openstack keystone: authorization bypass via improper ec2 token handling
A flaw was found in OpenStack Keystone. This vulnerability allows remote authenticated users to bypass intended authorization restrictions. This occurs because OpenStack Keystone does not properly handle EC2 (Elastic Compute Cloud) tokens when a user's role has been removed from a tenant. An attacker can leverage a token associated with a removed user role to gain unauthorized access.
- Record
CVE-2012-5571- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-639
- Updated
- 2026-11-02
EUVDEUVD-2012-0016
A flaw was found in OpenStack Keystone. This vulnerability allows remote authenticated users to bypass intended authorization restrictions. This occurs because OpenStack Keystone does not properly handle EC2 (Elastic Compute Cloud) tokens when a user's role has been removed from a tenant. An attacker can leverage a token associated with a removed user role to gain unauthorized access.
- Record
EUVD-2012-0016- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-qvpr-qm6w-6rcc
OpenStack Keystone intended authorization restrictions bypass
OpenStack Keystone Essex (2012.1) and Folsom (2012.2) does not properly handle EC2 tokens when the user role has been removed from a tenant, which allows remote authenticated users to bypass intended authorization restrictions by leveraging a token for the removed user role.
- Record
GHSA-qvpr-qm6w-6rcc- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-639
- Updated
- 2026-11-02
NVD
A flaw was found in OpenStack Keystone. This vulnerability allows remote authenticated users to bypass intended authorization restrictions. This occurs because OpenStack Keystone does not properly handle EC2 (Elastic Compute Cloud) tokens when a user's role has been removed from a tenant. An attacker can leverage a token associated with a removed user role to gain unauthorized access.
- Record
CVE-2012-5571- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-639, CWE-255
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-5571
A flaw was found in OpenStack Keystone. This vulnerability allows remote authenticated users to bypass intended authorization restrictions. This occurs because OpenStack Keystone does not properly handle EC2 (Elastic Compute Cloud) tokens when a user's role has been removed from a tenant. An attacker can leverage a token associated with a removed user role to gain unauthorized access.
- Record
DEBIAN-CVE-2012-5571- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-qvpr-qm6w-6rcc
OpenStack Keystone intended authorization restrictions bypass
OpenStack Keystone Essex (2012.1) and Folsom (2012.2) does not properly handle EC2 tokens when the user role has been removed from a tenant, which allows remote authenticated users to bypass intended authorization restrictions by leveraging a token for the removed user role.
- Record
GHSA-qvpr-qm6w-6rcc- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-639
- Updated
- 2026-11-02
Show 4 moreShow less
OSVRHSA-2012:1556
Red Hat Security Advisory: openstack-keystone security, bug fix, and enhancement update
- Record
RHSA-2012:1556- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-13
OSVRHSA-2012:1557
Red Hat Security Advisory: openstack-keystone security, bug fix, and enhancement update
- Record
RHSA-2012:1557- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-13
OSVNo score
OpenStack Keystone Essex (2012.1) and Folsom (2012.2) does not properly handle EC2 tokens when the user role has been removed from a tenant, which allows remote authenticated users to bypass intended authorization restrictions by leveraging a token for the removed user role.
- Record
CVE-2012-5571- Updated
- 2026-11-02
OSVPYSEC-2012-35No score
OpenStack Keystone Essex (2012.1) and Folsom (2012.2) does not properly handle EC2 tokens when the user role has been removed from a tenant, which allows remote authenticated users to bypass intended authorization restrictions by leveraging a token for the removed user role.
- Record
PYSEC-2012-35- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| facts | ||
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
lists.fedoraproject.org/pipermail/package-announce/2012-December/094286.html
rhn.redhat.com/errata/RHSA-2012-1556.html
secunia.com/advisories/51423
openwall.com/lists/oss-security/2012/11/28/5
Show 31 moreShow less
securityfocus.com/bid/56726
ubuntu.com/usn/USN-1641-1
access.redhat.com/errata/RHSA-2012:1556
bugs.launchpad.net/keystone/+bug/1064914
exchange.xforce.ibmcloud.com/vulnerabilities/80333
github.com/openstack/keystone/commit/37308dd4f3e33f7bd0f71d83fd51734d1870713b
nvd.nist.gov/vuln/detail/CVE-2012-5571
security-tracker.debian.org/tracker/CVE-2012-5571
bugzilla.redhat.com/show_bug.cgi?id=867029
security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_1556.json
cve.org/CVERecord?id=CVE-2012-5483