CVE-2026-22797
CriticalCVSS 9.9Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The external_oauth2_token middleware fails to sanitize incoming authentication headers before processing OAuth 2.0 tokens. By sending forged identity headers such as X-Is-Admin-Project, X-Roles, or X-User-Id, an authenticated attacker may escalate privileges or impersonate other users. All deployments using the external_oauth2_token middleware are affected.
Risk Assessment
An authenticated attacker can gain admin privileges or impersonate another user, potentially leading to unauthorized access to cloud resources and data theft.
Recommendation
Update keystonemiddleware to version 10.7.2, 10.9.1, or 10.12.1 depending on your branch. Also review the external_oauth2_token configuration.
Original NVD description (English source)
An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The external_oauth2_token middleware fails to sanitize incoming authentication headers before processing OAuth 2.0 tokens. By sending forged identity headers such as X-Is-Admin-Project, X-Roles, or X-User-Id, an authenticated attacker may escalate privileges or impersonate other users. All deployments using the external_oauth2_token middleware are affected.