OpenStack Keystone does not invalidate existing tokens when granting or revoking roles

Description

References

• nvd.nist.gov/vuln/detail/CVE-2012-4413 · ADVISORY
• access.redhat.com/errata/RHSA-2012:1378 · WEB
• access.redhat.com/security/cve/CVE-2012-4413 · WEB
• bugs.launchpad.net/keystone/+bug/1041396 · WEB
• bugzilla.redhat.com/show_bug.cgi · WEB
• exchange.xforce.ibmcloud.com/vulnerabilities/78478 · WEB
• opendev.org/openstack/keystone · PACKAGE
• review.opendev.org/c/openstack/keystone/+/12870 · WEB
• web.archive.org/web/20121114023848/http://www.securityfocus.com/bid/55524 · WEB
• openstack/keystone commit 58ac669 · WEB
• openwall.com/lists/oss-security/2012/09/12/7 · WEB
• ubuntu.com/usn/USN-1564-1

keystone 的其他漏洞

• CVE-2026-44394高危 8.1An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone federated token rescoping mechanism does not propagate the origina…
• CVE-2026-43000高危 8.8An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation vulnerability, an at…
• CVE-2026-42999高危 8.8An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone RBAC policy enforcer in enforce_call unconditionally merges the ra…
• CVE-2026-42998高危 8.8An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone application credential authentication plugin does not verify that …
• CVE-2026-43001高危 8.0An issue was discovered in OpenStack Keystone before 29.0.2. POST /v3/credentials did not validate that the caller-supplied project_id for a…