CVE-2012-5571 MEDIUM

CVE-2012-5571: Openstack keystone: openstack keystone: authorization bypass via improper ec2 token handling

Vendor Red Hat
Product Red Hat OpenStack Platform 13 (Queens)
Weakness CWE-639 · IDOR
Published December 18, 2012
Last update April 7, 2026
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

A flaw was found in OpenStack Keystone. This vulnerability allows remote authenticated users to bypass intended authorization restrictions. This occurs because OpenStack Keystone does not properly handle EC2 (Elastic Compute Cloud) tokens when a user's role has been removed from a tenant. An attacker can leverage a token associated with a removed user role to gain unauthorized access.

Key dates

02Disclosure timeline

December 18, 2012 CVE published
April 7, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-5234 LatePoint <= 5.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Financial Data Exposure via Sequential Invoice ID CVE-2026-32097 PingPong has improper access control in thread file endpoints allows access outside intended scope CVE-2023-22471 Nextcloud Deck vulnerable to authorization bypass CVE-2026-42463 SQLBot: Unauthorized Access Vulnerability CVE-2025-58627 WordPress Miraculous Core Plugin plugin < 2.0.9 - Insecure Direct Object References (IDOR) vulnerability