CVE-2013-4278: Openstack Compute

Low severity, CVSS 3.5. EPSS: 1.5% chance of exploitation in the next 30 days.

The "create an instance" API in OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not properly enforce the os-flavor-access:is_public property, which allows remote authenticated users to boot arbitrary flavors by guessing the flavor id. NOTE: this issue is due to an incomplete fix for CVE-2013-2256.

Affected products

• Openstack Compute: affected versions not specified

Published 2013-09-16. Last modified 2026-06-16.