OpenStack Compute (Nova) allows remote authenticated users to gain privileges via API requests

published 2014-04-15 12 y ago modified 2026-07-07 4 mo ago also GHSA-p258-xmh3-72pv , PYSEC-2026-878 , EUVD-2022-4654

cvss: 6.0; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.7%; EPSS 1.7% chance of exploitation in 30 days, percentile 76%
public exploits: 0; none known

The Nova EC2 API security group implementation in OpenStack Compute (Nova) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 does not enforce RBAC policies for (1) add_rules, (2) remove_rules, (3) destroy, and other unspecified methods in compute/api.py when using non-default policies, which allows remote authenticated users to gain privileges via these API requests.

Patch / fix

fixed in 1 distros 2 links 1

pypi nova 2013.2.4

debian red hat

nova Debian 14, Debian 13, Debian 12 2013.2.3-1

debian advisories DEBIAN-CVE-2014-0167

openstack-nova openstack 4 2013.2.3-12.el6ost
python-nova openstack 4 2013.2.3-12.el6ost
openstack-nova-api openstack 4 2013.2.3-12.el6ost
openstack-nova-cert openstack 4 2013.2.3-12.el6ost
openstack-nova-cells openstack 4 2013.2.3-12.el6ost
openstack-nova-common openstack 4 2013.2.3-12.el6ost
openstack-nova-compute openstack 4 2013.2.3-12.el6ost
openstack-nova-console openstack 4 2013.2.3-12.el6ost

red hat advisories RHSA-2014:1084

openwall.com/lists/oss-security/2014/04/09/26 patch

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2014-0167 updated 2026-07-31 cvss 6.0

openstack-nova: RBAC policy not properly enforced in Nova EC2 API

Red Hat Enterprise Linux OpenStack Platform 5 (Icehouse) openstack-nova Red Hat OpenStack Platform 3 openstack-nova
affected: no fix available
Red Hat Enterprise Linux OpenStack Platform 4.0 python-nova 2013.2.3-12.el6ost, openstack-nova 2013.2.3-12.el6ost, openstack-nova-api 2013.2.3-12.el6ost, openstack-nova-cert 2013.2.3-12.el6ost, openstack-nova-cells 2013.2.3-12.el6ost, openstack-nova-common 2013.2.3-12.el6ost, +7 more
fixed: vendor fix RHSA-2014:1084

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.65% chance of exploitation in the next 30 days, higher than 76% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	2.0	6.0	AV:N/AC:M/Au:S/C:P/I:P/A:P

Affected packages

ecosystem	package	affected	fixed in
pypi	nova	>=2013.1.0, <2013.2.4	2013.2.4

Classification

Weakness

CWE-264 Permissions, Privileges, and Access Controls
CWE-862 Missing Authorization

References

openwall.com /lists/oss-security/2014/04/09/26
mailing-list, web, patch
ubuntu.com /usn/USN-2247-1
vendor-advisory, web
launchpad.net /bugs/1290537
web, vendor-advisory
nvd.nist.gov /vuln/detail/CVE-2014-0167
advisory
access.redhat.com /errata/RHSA-2014:1084
web
access.redhat.com /security/cve/CVE-2014-0167
web
bugzilla.redhat.com /show_bug.cgi?id=1084868
web
opendev.org /openstack/nova
package
pypi.org /project/nova
package
github.com /advisories/GHSA-p258-xmh3-72pv
advisory

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary