Is CVE-2013-6419 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2013-6419 being exploited in the wild.

How severe is CVE-2013-6419?

Informational severity, with a CVSS score of 0, published 6 July 2026.

Which products and versions are affected?

OpenStack Neutron before Havana 2013.2.1 and Icehouse-1; nova (PyPI) ECOSYSTEM:introduced=0,fixed=12.0.0a0.

Is there a fix for CVE-2013-6419?

Yes. nova (PyPI): upgrade to 12.0.0a0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2013-6419 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2013-6419?

Check whether you run OpenStack Neutron or nova (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2013-6419: PYSEC-2026-858 - OpenStack Nova Router metadata queries are not restricted by tenant

CVE-2013-6419 · Severity: info · CVSS 0 · Published 2026-07-06

OpenStack Nova's metadata service did not properly validate which tenant was making a request, allowing a remote attacker from one tenant to obtain sensitive metadata from another tenant's instances by spoofing the instance ID. This could expose configuration data, environment variables, and other instance-specific information that should be isolated between separate customers or organizational units in a multi-tenant cloud.

Technologies: OpenStack Neutron, nova (PyPI). Vendors: OpenStack, PyPI.

Quick answers

Is CVE-2013-6419 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2013-6419 being exploited in the wild.
How severe is CVE-2013-6419?: Informational severity, with a CVSS score of 0, published 6 July 2026.
Which products and versions are affected?: OpenStack Neutron before Havana 2013.2.1 and Icehouse-1; nova (PyPI) ECOSYSTEM:introduced=0,fixed=12.0.0a0.
Is there a fix for CVE-2013-6419?: Yes. nova (PyPI): upgrade to 12.0.0a0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2013-6419 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2013-6419?: Check whether you run OpenStack Neutron or nova (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

nova (PyPI): upgrade to 12.0.0a0 or later
```
pip install "nova>=12.0.0a0"
```

Technical details

The vulnerability is an authorization/authentication bypass (CWE-200: Exposure of Sensitive Information) in Nova's metadata handler and Neutron's metadata agent. The root cause is insufficient validation of the tenant ID associated with metadata requests: an attacker could update a port's device_id in Neutron to match another tenant's instance ID and then retrieve that instance's metadata without proper tenant boundary checks. The attack is network-reachable and requires no authentication beyond being a valid cloud tenant. The fix adds X-Tenant-ID validation in the metadata request handler to ensure the requesting tenant matches the instance owner in the database. Patches were released in Nova 12.0.0a0 and corresponding Neutron versions (Havana 2013.2.1 and later, Icehouse-1).

Affected products

OpenStack Nova before 12.0.0a0
OpenStack Neutron before Havana 2013.2.1 and Icehouse-1

Identifiers

CVE-2013-6419
GHSA-22w9-j288-8p9w
PYSEC-2026-858

Timeline

2013-12-11: disclosed: Published to oss-security mailing list
2013: patched: Patch commits merged for Nova and Neutron
2022-05-17: advisory: GitHub Security Advisory GHSA-22w9-j288-8p9w published

References

https://github.com/openstack/nova/commit/07006be9165d1008ca0382b6f0ad25b13a676a55

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.