CVE-2026-22797
- State
- Published
- Severity
- 9.9 Critical
- Published
- Jan 19, 2026
- Updated
- Sep 10, 2026
- Reserved
- Jan 9, 2026
Description
An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The external_oauth2_token middleware fails to sanitize incoming authentication headers before processing OAuth 2.0 tokens. By sending forged identity headers such as X-Is-Admin-Project, X-Roles, or X-User-Id, an authenticated attacker may escalate privileges or impersonate other users. All deployments using the external_oauth2_token middleware are affected.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.9 Critical | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L | mitre |
| 3.1 | 9.9 Critical | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L | redhat-SADP |
Weaknesses
- CWE-290 Authentication Bypass by Spoofing
Affected Products
| Product | Versions |
|---|---|
keystonemiddlewareOpenStack |
|
References
- https://launchpad.net/bugs/2129018
- https://www.openwall.com/lists/oss-security/2026/01/16/9
- http://www.openwall.com/lists/oss-security/2026/01/15/1
- http://www.openwall.com/lists/oss-security/2026/01/16/2
- http://www.openwall.com/lists/oss-security/2026/01/16/3
- http://www.openwall.com/lists/oss-security/2026/01/16/9
- https://access.redhat.com/security/cve/CVE-2026-22797vdb-entry
- RHBZ#2430879issue-tracking
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22797.json
- https://access.redhat.com/errata/RHSA-2026:5907vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:5133vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:4434vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:3855vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:3402vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.