CVE-2012-3426: Keystone Token Expiration Bypass Vulnerability
Summary
PYSEC-2012-34: OpenStack Keystone before 2012.1.1, as used in OpenStack Folsom before Folsom-1 and OpenStack Essex, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization... Affects keystone across 6 version ranges.
< 29e74e73a6e51cffc0371b32354558391826a4aa
< 375838cfceb88cacc312ff6564e64eb18ee6a355
< 628149b3dc6b58b91fd08e6ca8d91c728ccb8626
< a67b24878a6156eab17b9098fa649f0279256f5d
< d9600434da14976463a0bd03abd8e0309f0db454
< ea03d05ed5de0c015042876100d37a6a14bf56de
Fixed in ea03d05ed5de0c015042876100d37a6a14bf56de. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keystone is the identity service used by OpenStack, providing authentication and authorization services for cloud applications. It manages user accounts, roles, and permissions, enabling secure access to resources. However, prior to version 2012.1.1, Keystone had a vulnerability related to token expiration, which could allow unauthorized access to resources.
Vulnerability Detail
The vulnerability arises from improper implementation of token expiration in OpenStack Keystone versions before 2012.1.1. This flaw allows remote authenticated users to bypass authorization restrictions through various means, including creating new tokens via token chaining, using tokens from disabled accounts, or exploiting tokens from accounts with changed passwords. The implications of this vulnerability are significant, as it can lead to unauthorized access to sensitive resources and data.
How To Fix
Latest published version: 30.0.0 as of 22 Oct 2026
pip install --upgrade "keystone==30.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
ea03d05ed5de0c015042876100d37a6a14bf56de
This is the first release that contains the fix.
pip install --upgrade "keystone==ea03d05ed5de0c015042876100d37a6a14bf56de"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, administrators can implement stricter access controls and monitor token usage closely until the system can be updated. Additionally, disabling token chaining may reduce the risk of exploitation.
Conclusion
The CVE-2012-3426 vulnerability in OpenStack Keystone poses significant security risks due to improper token expiration handling. It is crucial for users to update to a patched version to mitigate these risks and ensure the security of their cloud applications.
See every vulnerability recorded for keystone →
FAQ
CVE-2012-3426 is a vulnerability in OpenStack Keystone that allows authenticated users to bypass authorization restrictions due to improper token expiration handling.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
All versions of Keystone before 2012.1.1 are affected by this vulnerability.
The risks include unauthorized access to resources, potential data breaches, and the ability for attackers to exploit user accounts.
You can implement stricter access controls and monitor token usage closely as a temporary measure until you can apply the necessary updates.
Related vulnerabilities
Recent vulnerabilities recorded for keystone.
