---
id: CVE-2013-6419
aliases:
  - GHSA-22w9-j288-8p9w
  - PYSEC-2026-858
title: OpenStack Nova Router metadata queries are not restricted by tenant
summary: OpenStack Nova Router metadata queries are not restricted by tenant
severity: medium
vendor: nova
product: nova
ecosystem: pip
affected:
  - nova < 12.0.0a0
patched:
  - nova 12.0.0a0
published: '2022-05-17'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-22w9-j288-8p9w'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2013-6419'
  - url: >-
      https://github.com/openstack/nova/commit/07006be9165d1008ca0382b6f0ad25b13a676a55
  - url: >-
      https://github.com/openstack/nova/commit/af2f823107010933ecd94a9c938f8b739baaecb7
  - url: >-
      https://github.com/openstack/nova/commit/bce36e9bdb1fcb9658f7b684d160e656e88d816c
  - url: 'https://bugs.launchpad.net/neutron/+bug/1235450'
  - url: 'https://github.com/openstack/nova'
  - url: 'https://review.openstack.org/#/c/61428/2/nova/api/metadata/handler.py'
  - url: 'https://review.openstack.org/#/c/61439/1/neutron/agent/metadata/agent.py'
  - url: 'http://rhn.redhat.com/errata/RHSA-2014-0091.html'
  - url: 'http://rhn.redhat.com/errata/RHSA-2014-0231.html'
  - url: 'http://www.openwall.com/lists/oss-security/2013/12/11/8'
  - url: 'http://www.securityfocus.com/bid/64250'
tags:
  - osv
  - pip
epss: 0.01852
epssPercentile: 0.78197
ingestedAt: '2026-07-08T18:25:44.123Z'
---

## Overview

Interaction error in OpenStack Nova and Neutron before Havana 2013.2.1 and icehouse-1 does not validate the instance ID of the tenant making a request, which allows remote tenants to obtain sensitive metadata by spoofing the device ID that is bound to a port, which is not properly handled by (1) api/metadata/handler.py in Nova and (2) the neutron-metadata-agent (`agent/metadata/agent.py`) in Neutron.

## Affected packages

- `nova < 12.0.0a0`

## Remediation

Upgrade to a patched release:

- `nova 12.0.0a0`