CVE-2013-6391
The ec2tokens API in OpenStack Identity (Keystone) before Havana 2013.2.1 and Icehouse before...
CVE-2013-6391 is a medium vulnerability (CVSS 5.8) in Openstack Keystone, published December 14, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.24%, the 82nd percentile. Fixed in keystone 2013.2.1-1.
The ec2tokens API in OpenStack Identity (Keystone) before Havana 2013.2.1 and Icehouse before icehouse-2 does not return a trust-scoped token when one is received, which allows remote trust users to gain privileges by generating EC2 credentials from a trust-scoped token and using them in an ec2tokens API request.
Exploit likelihood
What each source reports
NVD Score used
The ec2tokens API in OpenStack Identity (Keystone) before Havana 2013.2.1 and Icehouse before icehouse-2 does not return a trust-scoped token when one is received, which allows remote trust users to gain privileges by generating EC2 credentials from a trust-scoped token and using them in an ec2tokens API request.
- Record
CVE-2013-6391- CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:N - Weakness
- CWE-269
- Updated
- 2026-11-02
CVE List No score
The ec2tokens API in OpenStack Identity (Keystone) before Havana 2013.2.1 and Icehouse before icehouse-2 does not return a trust-scoped token when one is received, which allows remote trust users to gain privileges by generating EC2 credentials from a trust-scoped token and using them in an ec2tokens API request.
- Record
CVE-2013-6391- Updated
- 2026-11-02
EUVDEUVD-2013-6215 No score
The ec2tokens API in OpenStack Identity (Keystone) before Havana 2013.2.1 and Icehouse before icehouse-2 does not return a trust-scoped token when one is received, which allows remote trust users to gain privileges by generating EC2 credentials from a trust-scoped token and using them in an ec2tokens API request.
- Record
EUVD-2013-6215- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3fpm-8w39-5p69 No score
The ec2tokens API in OpenStack Identity (Keystone) before Havana 2013.2.1 and Icehouse before...
The ec2tokens API in OpenStack Identity (Keystone) before Havana 2013.2.1 and Icehouse before icehouse-2 does not return a trust-scoped token when one is received, which allows remote trust users to gain privileges by generating EC2 credentials from a trust-scoped token and using them in an ec2tokens API request.
- Record
GHSA-3fpm-8w39-5p69- Weakness
- CWE-269
- Updated
- 2026-11-02
OSV No score
The ec2tokens API in OpenStack Identity (Keystone) before Havana 2013.2.1 and Icehouse before icehouse-2 does not return a trust-scoped token when one is received, which allows remote trust users to gain privileges by generating EC2 credentials from a trust-scoped token and using them in an ec2tokens API request.
- Record
CVE-2013-6391- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-6391 No score
The ec2tokens API in OpenStack Identity (Keystone) before Havana 2013.2.1 and Icehouse before icehouse-2 does not return a trust-scoped token when one is received, which allows remote trust users to gain privileges by generating EC2 credentials from a trust-scoped token and using them in an ec2tokens API request.
- Record
DEBIAN-CVE-2013-6391- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
keystoneDebian:12 |
before 2013.2.1-1 | 2013.2.1-1 |
keystoneDebian:13 |
before 2013.2.1-1 | 2013.2.1-1 |
keystoneDebian:14 |
before 2013.2.1-1 | 2013.2.1-1 |
openstack-keystoneRed Hat:openstack:4::el6 |
before 0:2013.2.1-1.el6ost | 0:2013.2.1-1.el6ost |
openstack-keystone-docRed Hat:openstack:4::el6 |
before 0:2013.2.1-1.el6ost | 0:2013.2.1-1.el6ost |
python-keystoneRed Hat:openstack:4::el6 |
before 0:2013.2.1-1.el6ost | 0:2013.2.1-1.el6ost |
openstack-keystoneRed Hat:openstack:3::el6 |
before 0:2013.1.5-2.el6ost | 0:2013.1.5-2.el6ost |
openstack-keystone-docRed Hat:openstack:3::el6 |
before 0:2013.1.5-2.el6ost | 0:2013.1.5-2.el6ost |
python-keystoneRed Hat:openstack:3::el6 |
before 0:2013.1.5-2.el6ost | 0:2013.1.5-2.el6ost |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
ubuntu.com/usn/USN-2061-1
securityfocus.com/bid/64253
openwall.com/lists/oss-security/2013/12/11/7
secunia.com/advisories/56154
rhn.redhat.com/errata/RHSA-2014-0089.html
Show 17 moreShow less
bugs.launchpad.net/keystone/+bug/1242597
exchange.xforce.ibmcloud.com/vulnerabilities/89657
nvd.nist.gov/vuln/detail/CVE-2013-6391
github.com/advisories/GHSA-3fpm-8w39-5p69
security-tracker.debian.org/tracker/CVE-2013-6391
access.redhat.com/errata/RHSA-2014:0089
bugzilla.redhat.com/show_bug.cgi?id=1039164
security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0089.json
cve.org/CVERecord?id=CVE-2013-6391