Medium severity5.4NVD Advisory· Published Dec 18, 2012· Updated Jun 16, 2026
CVE-2012-5571
CVE-2012-5571
Description
A flaw was found in OpenStack Keystone. This vulnerability allows remote authenticated users to bypass intended authorization restrictions. This occurs because OpenStack Keystone does not properly handle EC2 (Elastic Compute Cloud) tokens when a user's role has been removed from a tenant. An attacker can leverage a token associated with a removed user role to gain unauthorized access.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
KeystonePyPI | < 8.0.0a0 | 8.0.0a0 |
Affected products
3Patches
Vulnerability mechanics
References
18- www.openwall.com/lists/oss-security/2012/11/28/5nvdPatchWEB
- www.openwall.com/lists/oss-security/2012/11/28/6nvdPatchWEB
- bugs.launchpad.net/keystone/+bug/1064914nvdPatchWEB
- github.com/openstack/keystone/commit/37308dd4f3e33f7bd0f71d83fd51734d1870713bnvdPatchWEB
- github.com/openstack/keystone/commit/8735009dc5b895db265a1cd573f39f4acfca2a19nvdPatchWEB
- github.com/openstack/keystone/commit/9d68b40cb9ea818c48152e6c712ff41586ad9653nvdPatchWEB
- secunia.com/advisories/51423nvdVendor Advisory
- secunia.com/advisories/51436nvdVendor Advisory
- github.com/advisories/GHSA-qvpr-qm6w-6rccghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2012-5571ghsaADVISORY
- lists.fedoraproject.org/pipermail/package-announce/2012-December/094286.htmlnvdWEB
- rhn.redhat.com/errata/RHSA-2012-1556.htmlnvdWEB
- rhn.redhat.com/errata/RHSA-2012-1557.htmlnvdWEB
- www.ubuntu.com/usn/USN-1641-1nvdWEB
- access.redhat.com/security/cve/CVE-2012-5571nvdWEB
- exchange.xforce.ibmcloud.com/vulnerabilities/80333nvdWEB
- github.com/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2012-35.yamlghsaWEB
- www.securityfocus.com/bid/56726nvd
News mentions
0No linked articles in our index yet.