← Vulnerability feed

Vulnerability record · CVE-2012-5571 · published 18 December 2012

CVE-2012-5571: Openstack essex insecure direct object reference vulnerability

Openstack · Essex

A flaw was found in OpenStack Keystone. This vulnerability allows remote authenticated users to bypass intended authorization restrictions. This occurs because OpenStack Keystone does not properly handle EC2 (Elastic Compute Cloud) tokens when a user's role has been removed from a tenant. An attacker can leverage a token associated with a removed user role to gain unauthorized access.

5.4 CVSS 3.1 Medium EPSS 2.1% · top 19.5% CWE-639 · Insecure direct object referenceCWE-255 · CWE-255
5.4CVSS 3.1 base score, v2 3.5
2.1%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
29References
16 Jun 2026Last modified by NVD

Description

A flaw was found in OpenStack Keystone. This vulnerability allows remote authenticated users to bypass intended authorization restrictions. This occurs because OpenStack Keystone does not properly handle EC2 (Elastic Compute Cloud) tokens when a user's role has been removed from a tenant. An attacker can leverage a token associated with a removed user role to gain unauthorized access.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://lists.fedoraproject.org/pipermail/package-announce/2012-December/094286.html
http://rhn.redhat.com/errata/RHSA-2012-1556.html
http://rhn.redhat.com/errata/RHSA-2012-1557.html
http://secunia.com/advisories/51423 Vendor Advisory
http://secunia.com/advisories/51436 Vendor Advisory
http://www.openwall.com/lists/oss-security/2012/11/28/5 Patch
http://www.openwall.com/lists/oss-security/2012/11/28/6 Patch
http://www.securityfocus.com/bid/56726
http://www.ubuntu.com/usn/USN-1641-1
https://access.redhat.com/security/cve/CVE-2012-5571
https://bugs.launchpad.net/keystone/+bug/1064914 Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/80333
https://github.com/openstack/keystone/commit/37308dd4f3e33f7bd0f71d83fd51734d1870713b Patch
https://github.com/openstack/keystone/commit/8735009dc5b895db265a1cd573f39f4acfca2a19 Patch
https://github.com/openstack/keystone/commit/9d68b40cb9ea818c48152e6c712ff41586ad9653 Patch
http://lists.fedoraproject.org/pipermail/package-announce/2012-December/094286.html
http://rhn.redhat.com/errata/RHSA-2012-1556.html
http://rhn.redhat.com/errata/RHSA-2012-1557.html
http://secunia.com/advisories/51423 Vendor Advisory
http://secunia.com/advisories/51436 Vendor Advisory
http://www.openwall.com/lists/oss-security/2012/11/28/5 Patch
http://www.openwall.com/lists/oss-security/2012/11/28/6 Patch
http://www.securityfocus.com/bid/56726
http://www.ubuntu.com/usn/USN-1641-1
https://bugs.launchpad.net/keystone/+bug/1064914 Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/80333
https://github.com/openstack/keystone/commit/37308dd4f3e33f7bd0f71d83fd51734d1870713b Patch
https://github.com/openstack/keystone/commit/8735009dc5b895db265a1cd573f39f4acfca2a19 Patch
https://github.com/openstack/keystone/commit/9d68b40cb9ea818c48152e6c712ff41586ad9653 Patch

Track CVE-2012-5571 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2013-0261Openstack essex link following vulnerabilityA flaw was found in PackStack. A local user could exploit a symlink attack on a temporary file with a predictable name in the `/tmp` directory. This …EPSS 0.34%7.6CVE-2013-0335Openstack essex insufficient session expiration vulnerabilityOpenStack Compute (Nova) Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to gain access to a VM in opportunistic circu…EPSS 2.1%7.5CVE-2013-2161Openstack folsom code injection vulnerabilityXML injection vulnerability in account/utils.py in OpenStack Swift Folsom, Grizzly, and Havana allows attackers to trigger invalid or spoofed Swift r…EPSS 1.9%6.8CVE-2013-1865Openstack folsom improper authentication vulnerabilityOpenStack Keystone Folsom (2012.2) does not properly perform revocation checks for Keystone PKI tokens when done through a server, which allows remot…EPSS 2.6%6.5CVE-2013-0208Openstack essex permissions and access controls vulnerabilityThe boot-from-volume feature in OpenStack Compute (Nova) Folsom and Essex, when using nova-volumes, allows remote authenticated users to boot from ot…EPSS 2.5%6.4CVE-2013-4497Openstack havana permissions and access controls vulnerabilityThe XenAPI backend in OpenStack Compute (Nova) Folsom, Grizzly, and Havana before 2013.2 does not properly apply security groups (1) when resizing an…EPSS 1.8%5.5CVE-2013-0266Openstack essex incorrect default permissions vulnerabilityA flaw was found in the `puppetlabs-cinder` module, as used in PackStack. This vulnerability is due to incorrect file permissions, specifically world…EPSS 0.27%5.5CVE-2012-5482Openstack essex permissions and access controls vulnerabilityThe v2 API in OpenStack Glance Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to delete arbitrary non-protected image…EPSS 2.7%

Source: NIST National Vulnerability Database (record CVE-2012-5571), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.