CVE-2012-5571 in Folsom
Summary
by MITRE
A flaw was found in OpenStack Keystone. This vulnerability allows remote authenticated users to bypass intended authorization restrictions. This occurs because OpenStack Keystone does not properly handle EC2 (Elastic Compute Cloud) tokens when a user's role has been removed from a tenant. An attacker can leverage a token associated with a removed user role to gain unauthorized access.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 04/07/2026
The vulnerability identified as CVE-2012-5571 represents a critical authorization bypass flaw within OpenStack Keystone, the identity service that manages authentication and authorization for OpenStack cloud environments. This weakness specifically affects how Keystone processes EC2 (Elastic Compute Cloud) tokens when user roles are modified or removed from tenant associations, creating a persistent security gap that can be exploited by authenticated attackers. The flaw stems from improper token validation mechanisms that fail to properly invalidate or revoke access credentials when role changes occur within the system.
This vulnerability operates through a fundamental flaw in the token management lifecycle where EC2 tokens retain their validity even after a user's role has been stripped from a tenant. The technical implementation fails to maintain proper synchronization between the token's access permissions and the current role assignments within the Keystone service. When a user's role is removed from a tenant, the system should invalidate all associated tokens immediately, but this validation process is incomplete or absent, allowing attackers to continue using previously issued tokens that no longer should be valid. The flaw specifically impacts the authorization enforcement mechanisms within OpenStack's identity service, creating a scenario where role-based access control (RBAC) can be circumvented through token reuse.
The operational impact of this vulnerability is substantial as it allows remote authenticated users to maintain unauthorized access to cloud resources that they should no longer be permitted to access. This creates a persistent backdoor that can be exploited by both malicious insiders and external attackers who have gained initial authentication credentials. The vulnerability affects the core identity and access management functionality of OpenStack deployments, potentially allowing attackers to escalate privileges, access sensitive data, or perform unauthorized operations within the cloud environment. Organizations using OpenStack Keystone as their identity service are particularly vulnerable, as the flaw exists at the authentication layer and can compromise the entire cloud infrastructure's security posture.
Security mitigations for this vulnerability should focus on implementing proper token invalidation procedures and strengthening the role-based access control mechanisms within the Keystone service. Organizations should ensure that all token validation processes properly check current role assignments and immediately revoke access when role changes occur. The fix typically involves modifying the token handling logic to enforce strict validation against current user permissions and implementing proper token lifecycle management. This vulnerability aligns with CWE-284, which describes improper access control, and relates to ATT&CK techniques involving privilege escalation and unauthorized access. Organizations should also implement monitoring solutions to detect unusual token usage patterns and establish regular security audits of role assignments and token validity periods to prevent exploitation of this authorization bypass vulnerability.