Description
The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary user or get, create, or delete arbitrary services.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | keystone | 2012.1.1-9 | — |
| Debian 13 | keystone | 2012.1.1-9 | — |
| Debian 12 | keystone | 2012.1.1-9 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 1 | python-keystone +3 | 2012.1.2-4.el6 | RHSA-2012:1378 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | keystone | >= 2012.1, < 2012.1.2 | 2012.1.2 | GHSA-mf98-r2gf-2x3w |
Advisories 1
- RHSA-2012:1378 Red Hat Security Advisory: openstack-keystone security update Red Hat Security Advisories (RHSA) · Aug 8, 2026
References
- [oss-security] 20120928 [OSSA 2012-015] Some actions in Keystone admin API do not validate token (CVE-2012-4456) mailing-list
- 50665 third-party-advisory
- [openstack] 20120928 [OSSA 2012-015] Some actions in Keystone admin API do not validate token (CVE-2012-4456) mailing-list
- https://github.com/openstack/keystone/commit/24df3adb3f50cbb5ada411bc67aba8a781e6a431
- https://github.com/openstack/keystone/commit/14b136aed9d988f5a8f3e699bd4577c9b874d6c1
- https://bugs.launchpad.net/keystone/+bug/1006822
- 55716 vdb-entry
- https://bugs.launchpad.net/keystone/+bug/1006815
- https://github.com/openstack/keystone/commit/868054992faa45d6f42d822bf1588cb88d7c9ccb
- keystone-xauth-sec-bypass(78944) vdb-entry
- https://github.com/openstack/keystone/commit/1d146f5c32e58a73a677d308370f147a3271c2cb
- https://bugzilla.redhat.com/show_bug.cgi?id=861179