OpenStack Keystone 2012.1.3 does not invalidate existing tokens when granting or revoking…
Priority LOW 23CWE-264Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Partial · None
- Fix status
- Fixed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-264.
Summary
OpenStack Keystone 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to retain the privileges of the revoked roles.
Why it matters now
EPSS 0.01899 79th percentileScored 2026-11-07
Fix Fixed keystone (PyPI): 2012.1.3Red Hat: 1 advisory
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | keystone (PyPI) | before 2012.1.3 | 2012.1.3 | Patch available | GHSA-mrxv-65rv-6hxq |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- keystone (PyPI) Vendor— Affected before 2012.1.3 Fixed in 2012.1.3 Patch available GHSA-mrxv-65rv-6hxq
Remediation
- Fix · GHSA-mrxv-65rv-6hxq keystone (PyPI) Fixed in 2012.1.3 Advisory →
Red Hat 1 advisory
- RHSA-2012:1378 Released 2012-10-16 · Red Hat rating Importantopenstack-keystone security update
- RHOS Essex Release openstack-keystone-2012.1.2-4.el6, openstack-keystone-doc-2012.1.2-4.el6, python-keystone-2012.1.2-4.el6 +1
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| RHOS Essex Release | Fixed | RHSA-2012:1378 |
Timeline
- 2026-10-02 Threatist record created from CVE-2012-4413
- 2026-10-03 Alias added: GHSA-mrxv-65rv-6hxq
References
Other 10
- 85484
- [oss-security] 20120912 [OSSA 2012-014] Revoking a role does not affect existing tokens (CVE-2012-4413)
- https://access.redhat.com/errata/RHSA-2012:1378
- https://access.redhat.com/security/cve/CVE-2012-4413
- https://bugs.launchpad.net/keystone/+bug/1041396
- https://bugzilla.redhat.com/show_bug.cgi?id=855491
- https://opendev.org/openstack/keystone
- https://review.opendev.org/c/openstack/keystone/+/12870
- https://web.archive.org/web/20121114023848/http://www.securityfocus.com/bid/55524
- http://github.com/openstack/keystone/commit/58ac6691a21675be9e2ffb0f84a05fc3cd4d2e2e
More OpenStack Keystone vulnerabilities
- TI-2026-25942 Incorrect authorization in OpenStack Keystone CVSS 3.1MEDIUM 5.3
- TI-2020-10091 An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. CVSS 3.1HIGH 8.8
- TI-2020-10090 An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. CVSS 3.1HIGH 8.8
- TI-2019-14184 OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials… CVSS 3.1HIGH 8.8
- TI-2020-10089 An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. CVSS 3.1HIGH 8.8
- TI-2014-02273 The V3 API in OpenStack Identity (Keystone) 2013.1 before 2013.2.4 and icehouse before… CVSS 2.0HIGH 7.8
Sources
- CVE-2012-4413 · CVE Program
- CVE-2012-4413 · NVD
- FIRST EPSS
- GHSA-mrxv-65rv-6hxq · GitHub Advisory Database · CC BY 4.0
- CVE-2012-4413 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences