---
id: CVE-2014-0167
aliases:
  - GHSA-p258-xmh3-72pv
  - PYSEC-2026-878
title: >-
  OpenStack Compute (Nova) allows remote authenticated users to gain privileges
  via API requests
summary: >-
  OpenStack Compute (Nova) allows remote authenticated users to gain privileges
  via API requests
severity: medium
vendor: nova
product: nova
ecosystem: pip
affected:
  - 'nova >= 2013.1.0, < 2013.2.4'
patched:
  - nova 2013.2.4
published: '2022-05-17'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-p258-xmh3-72pv'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2014-0167'
  - url: 'https://access.redhat.com/errata/RHSA-2014:1084'
  - url: 'https://access.redhat.com/security/cve/CVE-2014-0167'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1084868'
  - url: 'https://launchpad.net/bugs/1290537'
  - url: 'https://opendev.org/openstack/nova'
  - url: 'http://www.openwall.com/lists/oss-security/2014/04/09/26'
  - url: 'http://www.ubuntu.com/usn/USN-2247-1'
tags:
  - osv
  - pip
epss: 0.01647
epssPercentile: 0.75039
ingestedAt: '2026-07-08T18:25:51.478Z'
---

## Overview

The Nova EC2 API security group implementation in OpenStack Compute (Nova) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 does not enforce RBAC policies for (1) add_rules, (2) remove_rules, (3) destroy, and other unspecified methods in compute/api.py when using non-default policies, which allows remote authenticated users to gain privileges via these API requests.

## Affected packages

- `nova >= 2013.1.0, < 2013.2.4`

## Remediation

Upgrade to a patched release:

- `nova 2013.2.4`