CVE-2012-4457 OpenStack Keystone Token authorization for a user in a disabled tenant is allowed

What is CVE-2012-4457?

CVE-2012-4457 is a medium-severity authentication bypass vulnerability in n/a, published on 9 Oct 2012. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-3 does not properly handle authorization tokens for disabled tenants, which allows remote authenticated users to access the tenant's resources by requesting a token for the tenant.

Weakness: CWE-287

Which versions are affected by CVE-2012-4457?

3 open source packages ship an affected version, including keystone and Keystone. It affects 1 product.

Products include Openstack Keystone.

How do I fix CVE-2012-4457?

Upgrade keystone to 8.0.0a0 or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2012-4457 being exploited?

There is no known exploitation of CVE-2012-4457 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2020-12690 Insufficient Session Expiration in OpenStack Keystone High 8.8
• CVE-2019-19687 OpenStack Keystone Credential Leakage High 8.8
• CVE-2026-43001 OpenStack Keystone has an Incorrect Authorization Issue High 7.9
• CVE-2014-2828 OpenStack Identity (Keystone) DoS through V3 API authentication chaining High 7.8
• CVE-2021-38155 OpenStack Keystone allows information disclosure during account locking High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2012-4457, GHSA-x8h4-xf47-pqc3, PYSEC-2026-834.