CVE-2012-4413: OpenStack Keystone does not invalidate existing tokens when granting or revoking roles
Summary
CVE-2012-4413: OpenStack Keystone does not invalidate existing tokens when granting or revoking roles. Affects keystone versions < 2012.1.3. Fixed in 2012.1.3. How to fix ↓
Also tracked for
- keystone · Debian:11
The same CVE-2012-4413 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenStack Keystone is an open-source identity service that provides authentication and authorization for other OpenStack services. It manages user authentication and authorization by issuing tokens that grant access to various resources within the OpenStack environment. Tokens are granted based on user roles, which define the level of access a user has. However, prior to version 2012.1.3, Keystone did not properly invalidate existing tokens when granting or revoking roles, allowing remote authenticated users to retain the privileges of revoked roles.
Vulnerability Detail
The vulnerability in OpenStack Keystone allows remote authenticated users to retain the privileges of revoked roles. When roles are granted or revoked, existing tokens are not invalidated, allowing users to continue accessing resources they should no longer have access to. This can lead to unauthorized access and potential security breaches within the OpenStack environment.
How To Fix
Latest published version: 30.0.0 as of 22 Oct 2026
pip install --upgrade "keystone==30.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2012.1.3
This is the first release that contains the fix.
pip install --upgrade "keystone==2012.1.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the fixed version of OpenStack Keystone.
Conclusion
OpenStack Keystone prior to version 2012.1.3 does not properly invalidate existing tokens when granting or revoking roles, allowing remote authenticated users to retain the privileges of revoked roles. To address this vulnerability, it is recommended to upgrade to version 2012.1.3 or later. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for keystone →
FAQ
OpenStack Keystone is an open-source identity service that provides authentication and authorization for other OpenStack services.
The vulnerability allows remote authenticated users to retain the privileges of revoked roles, potentially leading to unauthorized access and security breaches.
To fix this vulnerability, it is recommended to upgrade to version 2012.1.3 or later of OpenStack Keystone.
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the fixed version of OpenStack Keystone.
You can find more information about this vulnerability in the OpenStack Keystone advisory: [link to advisory]
Related vulnerabilities
Recent vulnerabilities recorded for keystone.
