CVE-2012-4413 OpenStack Keystone does not invalidate existing tokens when granting or revoking roles
Authenticated users retain revoked role privileges because tokens are not invalidated, allowing unauthorized access to resources.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2012-4413?
CVE-2012-4413 is a medium-severity vulnerability in n/a, published on 18 Sep 2012. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
OpenStack Keystone 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to retain the privileges of the revoked roles.
Weakness: CWE-264
Which versions are affected by CVE-2012-4413?
3 open source packages ship an affected version, including keystone. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
keystone PyPI | All versions | 2012.1.3 |
keystone PyPI | All versions | 2012.1.3 |
keystone PyPI | All versions | 2012.1.3 |
Products include Openstack Keystone.
How do I fix CVE-2012-4413?
Upgrade keystone to 2012.1.3 or later.
Is CVE-2012-4413 being exploited?
There is no known exploitation of CVE-2012-4413 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2020-12690 Insufficient Session Expiration in OpenStack Keystone
- CVE-2019-19687 OpenStack Keystone Credential Leakage
- CVE-2026-43001 OpenStack Keystone has an Incorrect Authorization Issue
- CVE-2014-2828 OpenStack Identity (Keystone) DoS through V3 API authentication chaining
- CVE-2021-38155 OpenStack Keystone allows information disclosure during account locking
Sources
Also known as DEBIAN-CVE-2012-4413, GHSA-mrxv-65rv-6hxq, PYSEC-2026-833.