---
id: CVE-2013-4278
aliases:
  - GHSA-43cm-73px-5v4m
  - PYSEC-2026-862
title: OpenStack Compute (Nova) Resource limit circumvention in Nova private flavors
summary: OpenStack Compute (Nova) Resource limit circumvention in Nova private flavors
severity: low
vendor: nova
product: nova
ecosystem: pip
affected:
  - nova < 12.0.0a0
patched:
  - nova 12.0.0a0
published: '2022-05-17'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-43cm-73px-5v4m'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2013-4278'
  - url: >-
      https://github.com/openstack/nova/commit/4054cc4a22a1fea997dec76afb5646fd6c6ea6b9
  - url: >-
      https://github.com/openstack/nova/commit/6825959560e06725d26625fd21f5c0b78b305492
  - url: >-
      https://github.com/openstack/nova/commit/8b686195afe7e6dfb46c56c1ef2fe9c993d8e495
  - url: 'https://bugs.launchpad.net/ossa/+bug/1212179'
  - url: 'https://github.com/openstack/nova'
  - url: >-
      http://lists.openstack.org/pipermail/openstack-announce/2013-August/000138.html
  - url: 'http://rhn.redhat.com/errata/RHSA-2013-1199.html'
tags:
  - osv
  - pip
epss: 0.01509
epssPercentile: 0.733
ingestedAt: '2026-07-08T18:25:45.237Z'
---

## Overview

The "create an instance" API in OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not properly enforce the os-flavor-access:is_public property, which allows remote authenticated users to boot arbitrary flavors by guessing the flavor id.  NOTE: this issue is due to an incomplete fix for CVE-2013-2256.

## Affected packages

- `nova < 12.0.0a0`

## Remediation

Upgrade to a patched release:

- `nova 12.0.0a0`