CVE-2012-4456: Keystone Improper Authentication Vulnerability
Summary
CVE-2012-4456: OpenStack Keystone Improper Authentication vulnerability. Affects keystone versions >= 2012.1, < 2012.1.2. Fixed in 2012.1.2. How to fix ↓
Also tracked for
- keystone · Debian:11
The same CVE-2012-4456 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenStack Keystone is an essential component of the OpenStack cloud computing platform, responsible for identity management and access control. It provides authentication and authorization services for users and services within the OpenStack ecosystem. Keystone allows users to manage their roles and permissions, making it a critical part of cloud security. However, vulnerabilities in Keystone can expose sensitive information and compromise the integrity of the cloud environment.
Vulnerability Detail
The vulnerability identified as CVE-2012-4456 affects the OS-KSADM/services and tenant APIs in OpenStack Keystone versions Essex before 2012.1.2 and Folsom before folsom-2. The issue arises from improper validation of the X-Auth-Token, which can be exploited by remote attackers. This flaw allows attackers to read the roles of arbitrary users or perform unauthorized actions such as creating, deleting, or modifying services. The lack of proper authentication mechanisms poses significant risks to user data and service integrity.
How To Fix
Latest published version: 30.0.0 as of 22 Oct 2026
pip install --upgrade "keystone==30.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2012.1.2
This is the first release that contains the fix.
pip install --upgrade "keystone==2012.1.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to restrict access to the Keystone APIs until the patch is applied. This can be done by implementing network-level controls or firewall rules to limit access to trusted IP addresses only.
Conclusion
CVE-2012-4456 is a critical vulnerability in OpenStack Keystone that can lead to unauthorized access and manipulation of user roles and services. It is crucial for users to upgrade to the latest patched versions to ensure the security of their cloud environment. Implementing additional access controls can further mitigate risks until the upgrade is completed.
See every vulnerability recorded for keystone →
FAQ
CVE-2012-4456 is a vulnerability in OpenStack Keystone that allows remote attackers to exploit improper authentication and access sensitive user roles and services.
The vulnerability affects Keystone versions Essex before 2012.1.2 and Folsom before folsom-2.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
The risks include unauthorized access to user roles and services, which can lead to data breaches and loss of service integrity.
The best mitigation is to upgrade to the patched version of Keystone. Additionally, implement network-level controls to restrict access to the APIs.
References
Related vulnerabilities
Recent vulnerabilities recorded for keystone.
