CVE-2013-4278

The "create an instance" API in OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not properly enforce the os-flavor-access:is_public property, which allows remote authenticated users to boot arbitrary flavors by guessing the flavor id. NOTE: this issue is due to an incomplete fix for CVE-2013-2256.

View graph Watch Export

CVSS v3.1

—

EPSS

1.51%

probability of exploitation in 30 days

CISA KEV

Not listed

no confirmed exploitation reported

News coverage

sources referencing this CVE

EPSS Trend

Aug 16, 2026 → Sep 1, 2026

▲ 0.01pp

1.50% → 1.51% over 2 tracked changes

Connections

2 relationships

CWE-264

source

Timeline

disclosure → media coverage

Sep 16, 2013

Disclosure — published as a CVE record. · last revised by NVD Apr 29, 2026