5.4
MEDIUM
CVSS 3.1
CVE-2012-5571
Openstack keystone: openstack keystone: authorization bypass via improper ec2 token handling
Overview
Description
A flaw was found in OpenStack Keystone. This vulnerability allows remote authenticated users to bypass intended authorization restrictions. This occurs because OpenStack Keystone does not properly handle EC2 (Elastic Compute Cloud) tokens when a user's role has been removed from a tenant. An attacker can leverage a token associated with a removed user role to gain unauthorized access.
Details
INFO
Published Date :
Dec. 18, 2012, 1:55 a.m.
Last Modified :
Oct. 30, 2026, 7:17 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
Impact
Affected Products
The following products are affected by CVE-2012-5571
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
Scoring
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework
for assessing the severity of vulnerabilities in software and systems.
We collect and displays CVSS scores from various sources for each CVE.
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 2.0 | LOW | [email protected] | ||||
| CVSS 3.1 | MEDIUM | [email protected] |
Solution
A vulnerability in OpenStack Keystone allows authenticated users to bypass authorization restrictions.
- Update the OpenStack Keystone, openstack-keystone-doc, and python-keystone packages.
- Restart the OpenStack services.
References
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2012-5571.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2012-5571 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2012-5571
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2012-5571 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2012-5571 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Oct. 30, 2026
Action Type Old Value New Value Added Reference http://lists.fedoraproject.org/pipermail/package-announce/2012-December/094286.html Added Reference http://rhn.redhat.com/errata/RHSA-2012-1556.html Added Reference http://rhn.redhat.com/errata/RHSA-2012-1557.html Added Reference http://secunia.com/advisories/51423 Added Reference http://secunia.com/advisories/51436 Added Reference http://www.openwall.com/lists/oss-security/2012/11/28/5 Added Reference http://www.openwall.com/lists/oss-security/2012/11/28/6 Added Reference http://www.securityfocus.com/bid/56726 Added Reference http://www.ubuntu.com/usn/USN-1641-1 Added Reference https://bugs.launchpad.net/keystone/+bug/1064914 Added Reference https://exchange.xforce.ibmcloud.com/vulnerabilities/80333 Added Reference https://github.com/openstack/keystone/commit/37308dd4f3e33f7bd0f71d83fd51734d1870713b Added Reference https://github.com/openstack/keystone/commit/8735009dc5b895db265a1cd573f39f4acfca2a19 Added Reference https://github.com/openstack/keystone/commit/9d68b40cb9ea818c48152e6c712ff41586ad9653 Removed Reference http://lists.fedoraproject.org/pipermail/package-announce/2012-December/094286.html Removed Reference http://rhn.redhat.com/errata/RHSA-2012-1556.html Removed Reference http://rhn.redhat.com/errata/RHSA-2012-1557.html Removed Reference http://secunia.com/advisories/51423 Removed Reference http://secunia.com/advisories/51436 Removed Reference http://www.openwall.com/lists/oss-security/2012/11/28/5 Removed Reference http://www.openwall.com/lists/oss-security/2012/11/28/6 Removed Reference http://www.securityfocus.com/bid/56726 Removed Reference http://www.ubuntu.com/usn/USN-1641-1 Removed Reference https://bugs.launchpad.net/keystone/+bug/1064914 Removed Reference https://exchange.xforce.ibmcloud.com/vulnerabilities/80333 Removed Reference https://github.com/openstack/keystone/commit/37308dd4f3e33f7bd0f71d83fd51734d1870713b Removed Reference https://github.com/openstack/keystone/commit/8735009dc5b895db265a1cd573f39f4acfca2a19 Removed Reference https://github.com/openstack/keystone/commit/9d68b40cb9ea818c48152e6c712ff41586ad9653 Removed Reference Type http://secunia.com/advisories/51423 Types: Vendor Advisory Removed Reference Type http://secunia.com/advisories/51436 Types: Vendor Advisory Removed Reference Type http://www.openwall.com/lists/oss-security/2012/11/28/5 Types: Patch Removed Reference Type http://www.openwall.com/lists/oss-security/2012/11/28/6 Types: Patch Removed Reference Type https://bugs.launchpad.net/keystone/+bug/1064914 Types: Patch Removed Reference Type https://github.com/openstack/keystone/commit/37308dd4f3e33f7bd0f71d83fd51734d1870713b Types: Patch Removed Reference Type https://github.com/openstack/keystone/commit/8735009dc5b895db265a1cd573f39f4acfca2a19 Types: Patch Removed Reference Type https://github.com/openstack/keystone/commit/9d68b40cb9ea818c48152e6c712ff41586ad9653 Types: Patch -
CVE Modified by [email protected]
Oct. 30, 2026
Action Type Old Value New Value Added Affected Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2012/5xxx/CVE-2012-5571.json">CVE-2012-5571</a> Added Reference http://lists.fedoraproject.org/pipermail/package-announce/2012-December/094286.html Added Reference http://rhn.redhat.com/errata/RHSA-2012-1556.html Added Reference http://rhn.redhat.com/errata/RHSA-2012-1557.html Added Reference http://secunia.com/advisories/51423 Added Reference http://secunia.com/advisories/51436 Added Reference http://www.openwall.com/lists/oss-security/2012/11/28/5 Added Reference http://www.openwall.com/lists/oss-security/2012/11/28/6 Added Reference http://www.securityfocus.com/bid/56726 Added Reference http://www.ubuntu.com/usn/USN-1641-1 Added Reference https://access.redhat.com/errata/RHSA-2012:1556 Added Reference https://access.redhat.com/errata/RHSA-2012:1557 Added Reference https://access.redhat.com/security/cve/CVE-2012-5571 Added Reference https://bugs.launchpad.net/keystone/+bug/1064914 Added Reference https://exchange.xforce.ibmcloud.com/vulnerabilities/80333 Added Reference https://github.com/openstack/keystone/commit/37308dd4f3e33f7bd0f71d83fd51734d1870713b Added Reference https://github.com/openstack/keystone/commit/8735009dc5b895db265a1cd573f39f4acfca2a19 Added Reference https://github.com/openstack/keystone/commit/9d68b40cb9ea818c48152e6c712ff41586ad9653 Removed Reference http://lists.fedoraproject.org/pipermail/package-announce/2012-December/094286.html Removed Reference http://rhn.redhat.com/errata/RHSA-2012-1556.html Removed Reference http://rhn.redhat.com/errata/RHSA-2012-1557.html Removed Reference http://secunia.com/advisories/51423 Removed Reference http://secunia.com/advisories/51436 Removed Reference http://www.openwall.com/lists/oss-security/2012/11/28/5 Removed Reference http://www.openwall.com/lists/oss-security/2012/11/28/6 Removed Reference http://www.securityfocus.com/bid/56726 Removed Reference http://www.ubuntu.com/usn/USN-1641-1 Removed Reference https://access.redhat.com/security/cve/CVE-2012-5571 Removed Reference https://bugs.launchpad.net/keystone/+bug/1064914 Removed Reference https://exchange.xforce.ibmcloud.com/vulnerabilities/80333 Removed Reference https://github.com/openstack/keystone/commit/37308dd4f3e33f7bd0f71d83fd51734d1870713b Removed Reference https://github.com/openstack/keystone/commit/8735009dc5b895db265a1cd573f39f4acfca2a19 Removed Reference https://github.com/openstack/keystone/commit/9d68b40cb9ea818c48152e6c712ff41586ad9653 Removed Reference Type http://secunia.com/advisories/51423 Types: Vendor Advisory Removed Reference Type http://secunia.com/advisories/51436 Types: Vendor Advisory Removed Reference Type http://www.openwall.com/lists/oss-security/2012/11/28/5 Types: Patch Removed Reference Type http://www.openwall.com/lists/oss-security/2012/11/28/6 Types: Patch Removed Reference Type https://bugs.launchpad.net/keystone/+bug/1064914 Types: Patch Removed Reference Type https://github.com/openstack/keystone/commit/37308dd4f3e33f7bd0f71d83fd51734d1870713b Types: Patch Removed Reference Type https://github.com/openstack/keystone/commit/8735009dc5b895db265a1cd573f39f4acfca2a19 Types: Patch Removed Reference Type https://github.com/openstack/keystone/commit/9d68b40cb9ea818c48152e6c712ff41586ad9653 Types: Patch -
CVE Modified by [email protected]
Jun. 16, 2026
Action Type Old Value New Value Added Affected [{'cpes': ['cpe:/a:redhat:openstack:13'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenStack Platform 13 (Queens)', 'packageName': 'redhat-user-workloads/openstack-keystone', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openstack:16.2'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenStack Platform 16.2', 'packageName': 'openstack-keystone', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openstack:16.2'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenStack Platform 16.2', 'packageName': 'redhat-user-workloads/openstack-keystone', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openstack:17.1'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenStack Platform 17.1', 'packageName': 'openstack-keystone', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openstack:17.1'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenStack Platform 17.1', 'packageName': 'redhat-user-workloads/openstack-keystone', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openstack:18.0'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenStack Platform 18.0', 'packageName': 'openstack-keystone', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openstack:18.0'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenStack Platform 18.0', 'packageName': 'redhat-user-workloads/openstack-keystone', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}] -
Status Change by [email protected]
Apr. 29, 2026
Action Type Old Value New Value -
CVE Modified by [email protected]
Apr. 07, 2026
Action Type Old Value New Value Changed Description OpenStack Keystone Essex (2012.1) and Folsom (2012.2) does not properly handle EC2 tokens when the user role has been removed from a tenant, which allows remote authenticated users to bypass intended authorization restrictions by leveraging a token for the removed user role. A flaw was found in OpenStack Keystone. This vulnerability allows remote authenticated users to bypass intended authorization restrictions. This occurs because OpenStack Keystone does not properly handle EC2 (Elastic Compute Cloud) tokens when a user's role has been removed from a tenant. An attacker can leverage a token associated with a removed user role to gain unauthorized access. Added CVSS V3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Added CWE CWE-639 Added Reference https://access.redhat.com/security/cve/CVE-2012-5571 -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Nov. 21, 2024
Action Type Old Value New Value Added Reference http://lists.fedoraproject.org/pipermail/package-announce/2012-December/094286.html Added Reference http://rhn.redhat.com/errata/RHSA-2012-1556.html Added Reference http://rhn.redhat.com/errata/RHSA-2012-1557.html Added Reference http://secunia.com/advisories/51423 Added Reference http://secunia.com/advisories/51436 Added Reference http://www.openwall.com/lists/oss-security/2012/11/28/5 Added Reference http://www.openwall.com/lists/oss-security/2012/11/28/6 Added Reference http://www.securityfocus.com/bid/56726 Added Reference http://www.ubuntu.com/usn/USN-1641-1 Added Reference https://bugs.launchpad.net/keystone/+bug/1064914 Added Reference https://exchange.xforce.ibmcloud.com/vulnerabilities/80333 Added Reference https://github.com/openstack/keystone/commit/37308dd4f3e33f7bd0f71d83fd51734d1870713b Added Reference https://github.com/openstack/keystone/commit/8735009dc5b895db265a1cd573f39f4acfca2a19 Added Reference https://github.com/openstack/keystone/commit/9d68b40cb9ea818c48152e6c712ff41586ad9653 -
CVE Modified by [email protected]
May. 14, 2024
Action Type Old Value New Value -
CVE Modified by [email protected]
Aug. 29, 2017
Action Type Old Value New Value Removed Reference http://xforce.iss.net/xforce/xfdb/80333 [No Types Assigned] Added Reference https://exchange.xforce.ibmcloud.com/vulnerabilities/80333 [No Types Assigned] -
Initial Analysis by [email protected]
Dec. 18, 2012
Action Type Old Value New Value
EPSS is a daily estimate of the probability of exploitation activity
being observed over the next 30 days. Following chart shows the EPSS
score history of the vulnerability.