---
id: CVE-2012-5571
title: >-
  Openstack keystone: openstack keystone: authorization bypass via improper ec2
  token handling
summary: >-
  A flaw was found in OpenStack Keystone. This vulnerability allows remote
  authenticated users to bypass intended authorization restrictions. This occurs
  because OpenStack Keystone does not properly handle EC2 (Elastic Compute
  Cloud) token…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: Red Hat
product: openstack-keystone
affected:
  - openstack-keystone (all versions)
  - openstack-keystone (all versions)
  - redhat-user-workloads/openstack-keystone (all versions)
  - openstack-keystone (all versions)
  - redhat-user-workloads/openstack-keystone (all versions)
  - openstack-keystone (all versions)
  - redhat-user-workloads/openstack-keystone (all versions)
  - openstack-keystone (all versions)
  - redhat-user-workloads/openstack-keystone (all versions)
published: '2012-12-18'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T18:03:41.392Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2012-5571'
references:
  - url: >-
      http://lists.fedoraproject.org/pipermail/package-announce/2012-December/094286.html
  - url: 'http://rhn.redhat.com/errata/RHSA-2012-1556.html'
  - url: 'http://rhn.redhat.com/errata/RHSA-2012-1557.html'
  - url: 'http://secunia.com/advisories/51423'
  - url: 'http://secunia.com/advisories/51436'
  - url: 'http://www.openwall.com/lists/oss-security/2012/11/28/5'
  - url: 'http://www.openwall.com/lists/oss-security/2012/11/28/6'
  - url: 'http://www.securityfocus.com/bid/56726'
  - url: 'http://www.ubuntu.com/usn/USN-1641-1'
  - url: 'https://access.redhat.com/errata/RHSA-2012:1556'
    label: 'RHSA-2012:1556'
  - url: 'https://access.redhat.com/errata/RHSA-2012:1557'
    label: 'RHSA-2012:1557'
  - url: 'https://access.redhat.com/security/cve/CVE-2012-5571'
  - url: 'https://bugs.launchpad.net/keystone/+bug/1064914'
  - url: 'https://exchange.xforce.ibmcloud.com/vulnerabilities/80333'
  - url: >-
      https://github.com/openstack/keystone/commit/37308dd4f3e33f7bd0f71d83fd51734d1870713b
  - url: >-
      https://github.com/openstack/keystone/commit/8735009dc5b895db265a1cd573f39f4acfca2a19
  - url: >-
      https://github.com/openstack/keystone/commit/9d68b40cb9ea818c48152e6c712ff41586ad9653
tags:
  - cve.org
epss: 0.02055
epssPercentile: 0.81339
ingestedAt: '2026-11-05T16:24:31.290Z'
---

## Overview

A flaw was found in OpenStack Keystone. This vulnerability allows remote authenticated users to bypass intended authorization restrictions. This occurs because OpenStack Keystone does not properly handle EC2 (Elastic Compute Cloud) tokens when a user's role has been removed from a tenant. An attacker can leverage a token associated with a removed user role to gain unauthorized access.

## Affected

- `openstack-keystone (all versions)`
- `openstack-keystone (all versions)`
- `redhat-user-workloads/openstack-keystone (all versions)`
- `openstack-keystone (all versions)`
- `redhat-user-workloads/openstack-keystone (all versions)`
- `openstack-keystone (all versions)`
- `redhat-user-workloads/openstack-keystone (all versions)`
- `openstack-keystone (all versions)`
- `redhat-user-workloads/openstack-keystone (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.