# CVE-2013-2255: PYSEC-2026-656 - OpenStack Keystone and other components vulnerable to Improper Certificate Validation

Source: https://junglewise.ai/threats/cve-2013-2255-openstack-keystone-and-other-components-vulnerable-to-improper  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-02  
License: CC BY 4.0 with a link back

CVE-2013-2255 · Severity: low · CVSS 3.1 · Published 2026-07-02

OpenStack Keystone and other components vulnerable to Improper Certificate Validation

Technologies: [cinder (PyPI)](https://junglewise.ai/threats/technologies/cinder), [keystone (PyPI)](https://junglewise.ai/threats/technologies/keystone), [neutron (PyPI)](https://junglewise.ai/threats/technologies/pypi-neutron), [python-keystoneclient (PyPI)](https://junglewise.ai/threats/technologies/python-keystoneclient). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2013-2255 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2013-2255 being exploited in the wild.

**How severe is CVE-2013-2255?** Low severity, with a CVSS score of 3.1, published 2 July 2026.

**Which products and versions are affected?** cinder (PyPI) ECOSYSTEM:introduced=0,fixed=7.0.0a0; keystone (PyPI) ECOSYSTEM:introduced=0,fixed=8.0.0a0; neutron (PyPI) ECOSYSTEM:introduced=0,fixed=7.0.0a0; python-keystoneclient (PyPI) ECOSYSTEM:introduced=0,fixed=0.4.0.

**Is there a fix for CVE-2013-2255?** Yes. cinder (PyPI): upgrade to 7.0.0a0 or later; keystone (PyPI): upgrade to 8.0.0a0 or later; neutron (PyPI): upgrade to 7.0.0a0 or later; python-keystoneclient (PyPI): upgrade to 0.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2013-2255?** Check whether you run cinder (PyPI), keystone (PyPI), neutron (PyPI) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- cinder (PyPI): upgrade to 7.0.0a0 or later

  ```sh
  pip install "cinder>=7.0.0a0"
  ```

- keystone (PyPI): upgrade to 8.0.0a0 or later

  ```sh
  pip install "keystone>=8.0.0a0"
  ```

- neutron (PyPI): upgrade to 7.0.0a0 or later

  ```sh
  pip install "neutron>=7.0.0a0"
  ```

- python-keystoneclient (PyPI): upgrade to 0.4.0 or later

  ```sh
  pip install "python-keystoneclient>=0.4.0"
  ```


## Affected products

- cinder (PyPI) ECOSYSTEM:introduced=0,fixed=7.0.0a0
- keystone (PyPI) ECOSYSTEM:introduced=0,fixed=8.0.0a0
- neutron (PyPI) ECOSYSTEM:introduced=0,fixed=7.0.0a0
- python-keystoneclient (PyPI) ECOSYSTEM:introduced=0,fixed=0.4.0

## Identifiers

- CVE-2013-2255
- GHSA-qh2x-hpf9-cf2g
- PYSEC-2026-2413
- PYSEC-2026-2677
- PYSEC-2026-3034
- PYSEC-2026-656

## Related threats

- [PYSEC-2026-2493 - OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access](https://junglewise.ai/threats/cve-2024-32498-openstack-cinder-glance-and-nova-vulnerable-to-arbitrary-file)
- [PYSEC-2026-2549 - OpenStack Identity Keystone and keystonemiddleware Insufficiently Protected Credentials](https://junglewise.ai/threats/cve-2015-7546-openstack-identity-keystone-and-keystonemiddleware-insufficiently)
- [PYSEC-2026-1693 - OpenStack Neutron can use an incorrect ID during policy enforcement](https://junglewise.ai/threats/cve-2024-53916-openstack-neutron-can-use-an-incorrect-id-during-policy)
- [PYSEC-2026-1694 - Denial of service in neutron](https://junglewise.ai/threats/cve-2023-3637-denial-of-service-in-neutron)
- [PYSEC-2026-855 - openstack-neutron uncontrolled resource consumption flaw](https://junglewise.ai/threats/cve-2022-3277-openstack-neutron-uncontrolled-resource-consumption-flaw)