CVE-2012-4457

OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-3 does not properly handle authorization tokens for disabled tenants, which allows remote authenticated users to access the tenant's resources by requesting a token for the tenant.

• CWE-287

• http://secunia.com/advisories/50665Third Party Advisory
• http://www.openwall.com/lists/oss-security/2012/09/28/6Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/55716Third Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=861180Issue Tracking, Third Party Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/78947Third Party Advisory, VDB Entry
• https://github.com/openstack/keystone/commit/4ebfdfaf23c6da8e3c182bf3ec2cb2b7132ef685Third Party Advisory
• https://github.com/openstack/keystone/commit/5373601bbdda10f879c08af1698852142b75f8d5Third Party Advisory
• https://lists.launchpad.net/openstack/msg17035.htmlThird Party Advisory
• http://secunia.com/advisories/50665Third Party Advisory
• http://www.openwall.com/lists/oss-security/2012/09/28/6Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/55716Third Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=861180Issue Tracking, Third Party Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/78947Third Party Advisory, VDB Entry
• https://github.com/openstack/keystone/commit/4ebfdfaf23c6da8e3c182bf3ec2cb2b7132ef685Third Party Advisory
• https://github.com/openstack/keystone/commit/5373601bbdda10f879c08af1698852142b75f8d5Third Party Advisory
• https://lists.launchpad.net/openstack/msg17035.htmlThird Party Advisory

Published

Oct 9, 2012

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-4451Multiple cross-site scripting (XSS) vulnerabilities in Zend …6.1
• CVE-2012-4452MySQL 5.0.88, and possibly other versions and platforms, all…
• CVE-2012-4453dracut.sh in dracut, as used in Red Hat Enterprise Linux 6, …
• CVE-2012-4454openCryptoki before 2.4.1, when using spinlocks, allows loca…
• CVE-2012-4455openCryptoki 2.4.1 allows local users to create or set world…
• CVE-2012-4456The (1) OS-KSADM/services and (2) tenant APIs in OpenStack K…
• CVE-2012-4458The AMQP type decoder in Apache Qpid 0.20 and earlier allows…
• CVE-2012-4459Integer overflow in the qpid::framing::Buffer::checkAvailabl…
• CVE-2012-4460The serializing/deserializing functions in the qpid::framing…
• CVE-2012-4461The KVM subsystem in the Linux kernel before 3.6.9, when run…
• CVE-2012-4462aviary/jobcontrol.py in Condor, as used in Red Hat Enterpris…
• CVE-2012-4463Midnight Commander (mc) 4.8.5 does not properly handle the (…