CVE-2012-5571: Keystone EC2 Token Authorization Bypass Vulnerability
Summary
PYSEC-2012-35: OpenStack Keystone Essex (2012.1) and Folsom (2012.2) does not properly handle EC2 tokens when the user role has been removed from a tenant, which allows remote authenticated users to bypass intended authorization restri... Affects keystone across 3 version ranges.
< 9d68b40cb9ea818c48152e6c712ff41586ad9653
< 37308dd4f3e33f7bd0f71d83fd51734d1870713b
< 8735009dc5b895db265a1cd573f39f4acfca2a19
Fixed in 37308dd4f3e33f7bd0f71d83fd51734d1870713b. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenStack Keystone is an open-source identity service used for authentication and authorization in cloud environments. It provides a central directory of users and their associated roles and permissions, enabling secure access to various cloud services. The Keystone service is crucial for managing user identities and roles, but it has been found to have vulnerabilities that can be exploited if not properly addressed.
Vulnerability Detail
The vulnerability identified as CVE-2012-5571 affects OpenStack Keystone versions Essex (2012.1) and Folsom (2012.2). It arises from improper handling of EC2 tokens when a user role has been removed from a tenant. This flaw allows remote authenticated users to bypass intended authorization restrictions by leveraging a token associated with a role that has been revoked. As a result, unauthorized access to resources may occur, posing significant security risks to cloud environments.
How To Fix
Latest published version: 30.0.0 as of 22 Oct 2026
pip install --upgrade "keystone==30.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
37308dd4f3e33f7bd0f71d83fd51734d1870713b
This is the first release that contains the fix.
pip install --upgrade "keystone==37308dd4f3e33f7bd0f71d83fd51734d1870713b"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to closely monitor user roles and tokens, ensuring that any removed roles are not still being utilized by active tokens. Implementing stricter token validation checks can also help mitigate the risk until a proper patch is applied.
Conclusion
CVE-2012-5571 represents a significant security risk for users of OpenStack Keystone, particularly in cloud environments where proper role management is critical. It is essential to apply the recommended updates to mitigate this vulnerability and ensure secure access control.
See every vulnerability recorded for keystone →
FAQ
CVE-2012-5571 is a vulnerability in OpenStack Keystone that allows unauthorized access through EC2 tokens even after user roles have been removed.
The vulnerability affects OpenStack Keystone versions Essex (2012.1) and Folsom (2012.2).
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, implement stricter token validation and monitor user roles closely as a temporary workaround.
More information can be found in the Open Source Vulnerability database and through the official OpenStack documentation.
Related vulnerabilities
Recent vulnerabilities recorded for keystone.
