Read the docs
TI-2012-04687 Aliases CVE-2012-5571GHSA-qvpr-qm6w-6rcc

Openstack keystone: openstack keystone: authorization bypass via improper ec2 token handling

Priority LOW 28CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 2 fixed, 4 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-639.

Summary

A flaw was found in OpenStack Keystone. This vulnerability allows remote authenticated users to bypass intended authorization restrictions. This occurs because OpenStack Keystone does not properly handle EC2 (Elastic Compute Cloud) tokens when a user's role has been removed from a tenant. An attacker can leverage a token associated with a removed user role to gain unauthorized access.

Why it matters now

EPSS 0.02047 81st percentileScored 2026-11-07
Fix Partial Keystone (PyPI): 8.0.0a0Red Hat: 2 advisoriesRed Hat: 2 fixed, 4 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatOpenStack Essex for RHEL 6—2012.1.3-3.el6Patch availableCNA
Red HatOpenStack Folsom for RHEL 6—2012.2.1-1.el6ostPatch availableCNA
Red HatRed Hat OpenStack Platform 13 (Queens)——No fix listedCNA
Red HatRed Hat OpenStack Platform 16.2——No fix listedCNA
Red HatRed Hat OpenStack Platform 16.2——No fix listedCNA
Red HatRed Hat OpenStack Platform 17.1——No fix listedCNA
Red HatRed Hat OpenStack Platform 17.1——No fix listedCNA
Red HatRed Hat OpenStack Platform 18.0——No fix listedCNA
Red HatRed Hat OpenStack Platform 18.0——No fix listedCNA
—Keystone (PyPI)before 8.0.0a08.0.0a0Patch availableGHSA-qvpr-qm6w-6rcc
  • OpenStack Essex for RHEL 6 VendorRed Hat Affected — Fixed in 2012.1.3-3.el6 Patch available CNA
  • OpenStack Folsom for RHEL 6 VendorRed Hat Affected — Fixed in 2012.2.1-1.el6ost Patch available CNA
  • Red Hat OpenStack Platform 13 (Queens) VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat OpenStack Platform 16.2 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat OpenStack Platform 16.2 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat OpenStack Platform 17.1 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat OpenStack Platform 17.1 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat OpenStack Platform 18.0 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat OpenStack Platform 18.0 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Keystone (PyPI) Vendor— Affected before 8.0.0a0 Fixed in 8.0.0a0 Patch available GHSA-qvpr-qm6w-6rcc

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:openstack:essex:2012.1:*:*:*:*:*:*:*2012.1VulnerableOpenStack
cpe:2.3:a:openstack:folsom:2012.2:*:*:*:*:*:*:*2012.2VulnerableOpenStack
  • cpe:2.3:a:openstack:essex:2012.1:*:*:*:*:*:*:* Versions 2012.1 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:folsom:2012.2:*:*:*:*:*:*:* Versions 2012.2 Vulnerable ·OpenStack

Remediation

  • Fix · GHSA-qvpr-qm6w-6rcc Keystone (PyPI) Fixed in 8.0.0a0 Advisory →

Red Hat 2 advisories

  • RHSA-2012:1557 Released 2012-12-10 · Red Hat rating Moderate
    openstack-keystone security, bug fix, and enhancement update
    • OpenStack Folsom openstack-keystone-2012.2.1-1.el6ost, openstack-keystone-doc-2012.2.1-1.el6ost, python-keystone-2012.2.1-1.el6ost
  • RHSA-2012:1556 Released 2012-12-10 · Red Hat rating Moderate
    openstack-keystone security, bug fix, and enhancement update
    • RHOS Essex Release openstack-keystone-2012.1.3-3.el6, openstack-keystone-doc-2012.1.3-3.el6, python-keystone-2012.1.3-3.el6 +1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix yet: Fix deferred
Red Hat OpenStack Platform 16.2AffectedNo fix yet: Fix deferred
Red Hat OpenStack Platform 17.1AffectedNo fix yet: Fix deferred
Red Hat OpenStack Platform 18.0AffectedNo fix yet: Fix deferred
OpenStack FolsomFixed RHSA-2012:1557
RHOS Essex ReleaseFixed RHSA-2012:1556

Timeline

  1. 2026-10-02 Threatist record created from CVE-2012-5571
  2. 2026-10-03 Alias added: GHSA-qvpr-qm6w-6rcc
  3. 2026-10-30 Fix available: openstack-keystone@0:2012.1.3-3.el6, openstack-keystone@0:2012.2.1-1.el6ost · CNA
  4. 2026-10-30 2 new references · CNA
  5. 2026-10-30 Fix available: RHSA-2012:1556 · Red Hat
  6. 2026-10-30 Fix available: RHSA-2012:1557 · Red Hat
  7. 2026-10-30 Fix available: OpenStack Folsom, RHOS Essex Release · Red Hat

References

Patch 6

Advisory 3

Other 7

  • TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
See all 7412 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences