CVE-2012-5578: Python keyring has insecure permissions on new databases allowing world-readable files to be created

Security readout for executives and security teams

Python keyring versions up to 0.10 could create new credential databases with permissions that let other local users read them. The business risk is unintended disclosure of stored secrets on shared systems, developer workstations, or build hosts. The source bundle does not provide a CVSS score or confirm active exploitation. Exposure is most plausible where Python keyring <= 0.10 is installed and creates credential databases on shared or multi-user systems. Single-user systems still have risk if backups, containers, or file shares expose those files. Treat this as a focused credential-exposure cleanup, not an internet-scale emergency. Prioritize shared systems and environments where secrets stored by Python keyring could be read by other local users. Mitigation focus: Identify Python keyring installations and versions across managed systems.; Apply vendor or distribution guidance for fixed Python keyring packages.; Review existing keyring database file permissions for unintended read access..

Prepared

Jun 6, 2026, 04:48 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.