CVE-2012-3542: OpenStack Keystone Arbitrary User Addition
Summary
CVE-2012-3542: OpenStack Keystone, as used in OpenStack Folsom before folsom-rc1 and OpenStack Essex (2012.1), allows remote attackers to add an arbitrary user to an arbitrary tenant via a request to update the user's default tenant to... Affects keystone across 2 version ranges.
< 5438d3b5a219d7c8fa67e66e538d325a61617155
< c13d0ba606f7b2bdc609a7f388334e5efec3f3aa
Fixed in 5438d3b5a219d7c8fa67e66e538d325a61617155. How to fix ↓
Also tracked for
- keystone · Debian:11
The same CVE-2012-3542 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OpenStack Keystone is an identity service used in OpenStack Folsom and OpenStack Essex. It provides authentication and authorization for other OpenStack services. Keystone allows users to manage tenants, roles, and users within an OpenStack cloud environment.
Vulnerability Detail
The vulnerability (CVE-2012-3542) in OpenStack Keystone allows remote attackers to add an arbitrary user to an arbitrary tenant by sending a request to update the user's default tenant via the administrative API. This vulnerability can be exploited to gain unauthorized access and potentially perform malicious actions within the affected OpenStack environment.
How To Fix
Latest published version: 30.0.0 as of 22 Oct 2026
pip install --upgrade "keystone==30.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5438d3b5a219d7c8fa67e66e538d325a61617155
This is the first release that contains the fix.
pip install --upgrade "keystone==5438d3b5a219d7c8fa67e66e538d325a61617155"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the fixed versions of OpenStack Keystone.
Conclusion
The vulnerability (CVE-2012-3542) in OpenStack Keystone allows unauthorized addition of users to tenants. To mitigate this vulnerability, it is crucial to upgrade to the fixed versions of OpenStack Keystone. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for keystone →
FAQ
OpenStack Keystone is an identity service used in OpenStack cloud environments. It provides authentication and authorization for other OpenStack services.
This vulnerability allows remote attackers to add an arbitrary user to an arbitrary tenant, potentially gaining unauthorized access and performing malicious actions within the affected OpenStack environment.
To fix this vulnerability, upgrade to a fixed version of OpenStack Keystone. For OpenStack Folsom, upgrade to folsom-rc1 or later. For OpenStack Essex, upgrade to version 2012.1 or later.
No, there is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading to the fixed versions of OpenStack Keystone.
For more information about this vulnerability, you can refer to the OpenStack Keystone advisory PYSEC-2012-19 available at https://github.com/pypa/advisory-database/blob/main/vulns/keystone/PYSEC-2012-19.yaml
Related vulnerabilities
Recent vulnerabilities recorded for keystone.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
