Log in Start free

Vulnerability · Published Jan 19, 2026 · Assigned by mitre

CVE-2026-22797

Critical 9.9

In plain English

A critical-severity authentication bypass by spoofing in keystonemiddleware from OpenStack. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.9Critical
Exploit odds (30 days)0.7%top 48.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The external_oauth2_token middleware fails to sanitize incoming authentication headers before processing OAuth 2.0 tokens. By sending forged identity headers such as X-Is-Admin-Project, X-Roles, or X-User-Id, an authenticated attacker may escalate privileges or impersonate other users. All deployments using the external_oauth2_token middleware are affected.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13python-keystonemiddleware10.9.0-2+deb13u1DSA-6104-1
Debian:13python-keystonemiddleware10.9.0-2+deb13u1DEBIAN-CVE-2026-22797
Debian:14python-keystonemiddleware10.12.0-3DEBIAN-CVE-2026-22797
Ubuntu:24.04:LTSpython-keystonemiddleware10.6.0-0ubuntu1.1UBUNTU-CVE-2026-22797
Ubuntu:25.10python-keystonemiddleware10.12.0-0ubuntu1.1UBUNTU-CVE-2026-22797

Affected products (as reported)

VendorProductVersions
OpenStack keystonemiddleware 10.5.0 – before 10.7.210.8.0 – before 10.9.110.10.0 – before 10.12.1

Weakness: CWE-290 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

References