Openstack keystone: openstack keystone: authorization bypass via improper ec2 token handling

Description

A flaw was found in OpenStack Keystone. This vulnerability allows remote authenticated users to bypass intended authorization restrictions. This occurs because OpenStack Keystone does not properly handle EC2 (Elastic Compute Cloud) tokens when a user's role has been removed from a tenant. An attacker can leverage a token associated with a removed user role to gain unauthorized access.

Scores

EPSS (exploitation in 30 days)

2.1% · top 19% of all CVEs (3 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.4.

Weakness

• CWE-639: Authorization Bypass Through User-Controlled Key (opens in a new tab)All about CWE-639 and its CVEs
• CWE-255 (opens in a new tab)All about CWE-255 and its CVEs

Affected products

• Red Hat · OpenStack Essex for RHEL 6

  • unaffected 0:2012.1.3-3.el6 – < *

• Red Hat · OpenStack Folsom for RHEL 6

  • unaffected 0:2012.2.1-1.el6ost – < *

• Red Hat · Red Hat OpenStack Platform 13 (Queens)

  All versions: affected

• Red Hat · Red Hat OpenStack Platform 16.2

  All versions: affected

• Red Hat · Red Hat OpenStack Platform 16.2

  All versions: affected

• Red Hat · Red Hat OpenStack Platform 17.1

  All versions: affected

• Red Hat · Red Hat OpenStack Platform 17.1

  All versions: affected

• Red Hat · Red Hat OpenStack Platform 18.0

  All versions: affected

• Red Hat · Red Hat OpenStack Platform 18.0

  All versions: affected

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• PyPIKeystoneGHSA-qvpr-qm6w-6rcc (opens in a new tab)

References (17)

• http://lists.fedoraproject.org/pipermail/package-announce/2012-December/094286.html (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• http://rhn.redhat.com/errata/RHSA-2012-1556.html (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• http://rhn.redhat.com/errata/RHSA-2012-1557.html (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• http://secunia.com/advisories/51423 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• http://secunia.com/advisories/51436 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• http://www.openwall.com/lists/oss-security/2012/11/28/5 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• http://www.openwall.com/lists/oss-security/2012/11/28/6 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• http://www.securityfocus.com/bid/56726 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
• http://www.ubuntu.com/usn/USN-1641-1 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
• RHSA-2012:1556 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• RHSA-2012:1557 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/security/cve/CVE-2012-5571 (opens in a new tab)vdb-entryx_refsource_REDHAT
• https://bugs.launchpad.net/keystone/+bug/1064914 (opens in a new tab)x_refsource_CONFIRMx_transferred
• https://exchange.xforce.ibmcloud.com/vulnerabilities/80333 (opens in a new tab)vdb-entryx_refsource_XFx_transferred
• https://github.com/openstack/keystone/commit/37308dd4f3e33f7bd0f71d83fd51734d1870713b (opens in a new tab)x_refsource_CONFIRMx_transferred
• https://github.com/openstack/keystone/commit/8735009dc5b895db265a1cd573f39f4acfca2a19 (opens in a new tab)x_refsource_CONFIRMx_transferred
• https://github.com/openstack/keystone/commit/9d68b40cb9ea818c48152e6c712ff41586ad9653 (opens in a new tab)x_refsource_CONFIRMx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-qvpr-qm6w-6rcc (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2012-5571](https://trackcve.app/badge/CVE-2012-5571.svg)](https://trackcve.app/cve/CVE-2012-5571)

Record last updated 30 Oct 2026, 18:03 UTC.