{"id":"CVE-2026-22797","aliases":["DEBIAN-CVE-2026-22797","DSA-6104-1","EUVD-2026-3202","GHSA-4428-9rh9-r27g","UBUNTU-CVE-2026-22797","USN-8008-1","openSUSE-SU-2026:10070-1"],"status":"published","title":"An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and...","description":"An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The external_oauth2_token middleware fails to sanitize incoming authentication headers before processing OAuth 2.0 tokens. By sending forged identity headers such as X-Is-Admin-Project, X-Roles, or X-User-Id, an authenticated attacker may escalate privileges or impersonate other users. All deployments using the external_oauth2_token middleware are affected.","severity":{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00652,"percentile":0.51509,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-290"],"published":"2026-01-19T00:00:00Z","modified":"2026-10-01T03:02:57Z","fixes":[{"ecosystem":"Debian:13","package":"python-keystonemiddleware","fixed_in":["10.9.0-2+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-keystonemiddleware","fixed_in":["10.12.0-3"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"python-keystonemiddleware","fixed_in":["10.6.0-0ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"python-keystonemiddleware","fixed_in":["10.12.0-0ubuntu1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-keystonemiddleware","fixed_in":["10.12.0-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:13","package":"python-keystonemiddleware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.9.0-2+deb13u1"}]}],"versions":["10.9.0-2"]},{"source":"osv","ecosystem":"Debian:14","package":"python-keystonemiddleware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.12.0-3"}]}],"versions":["10.12.0-1","10.12.0-2","10.9.0-2"]},{"source":"osv","ecosystem":"Debian:13","package":"python-keystonemiddleware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.9.0-2+deb13u1"}]}],"versions":["10.9.0-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-keystonemiddleware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.6.0-0ubuntu1.1"}]}],"versions":["10.4.1-0ubuntu1","10.5.0-0ubuntu1","10.5.0-0ubuntu2","10.6.0-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"python-keystonemiddleware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.12.0-0ubuntu1.1"}]}],"versions":["10.9.0-0ubuntu1","10.11.0-0ubuntu1","10.12.0-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-keystonemiddleware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.6.0-0ubuntu1.1"}]}],"versions":["10.4.1-0ubuntu1","10.5.0-0ubuntu1","10.5.0-0ubuntu2","10.6.0-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"python-keystonemiddleware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.12.0-0ubuntu1.1"}]}],"versions":["10.9.0-0ubuntu1","10.11.0-0ubuntu1","10.12.0-0ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-keystonemiddleware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.12.0-2.1"}]}]}],"products":[{"vendor":"openstack","product":"keystonemiddleware"},{"vendor":"red hat","product":"red hat openshift container platform 4.17"},{"vendor":"red hat","product":"red hat openshift container platform 4.18"},{"vendor":"red hat","product":"red hat openshift container platform 4.19"},{"vendor":"red hat","product":"red hat openshift container platform 4.20"},{"vendor":"red hat","product":"red hat openshift container platform 4.21"},{"vendor":"red hat","product":"red hat openstack platform 13 (queens)"},{"vendor":"red hat","product":"red hat openstack platform 16.2"},{"vendor":"red hat","product":"red hat openstack platform 17.1"},{"vendor":"red hat","product":"red hat openstack platform 18.0"}],"references":[{"url":"https://launchpad.net/bugs/2129018"},{"url":"https://www.openwall.com/lists/oss-security/2026/01/16/9"},{"url":"http://www.openwall.com/lists/oss-security/2026/01/15/1"},{"url":"http://www.openwall.com/lists/oss-security/2026/01/16/2"},{"url":"http://www.openwall.com/lists/oss-security/2026/01/16/3"},{"url":"http://www.openwall.com/lists/oss-security/2026/01/16/9"},{"url":"https://access.redhat.com/security/cve/CVE-2026-22797","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430879","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22797.json","tags":["x_sadp-csaf-vex"]},{"url":"https://access.redhat.com/errata/RHSA-2026:5907","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:5133","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:4434","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:3855","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:3402","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22797"},{"url":"https://github.com/advisories/GHSA-4428-9rh9-r27g"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-22797","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-22797","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-22797","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/01/15/1","tags":["report"]},{"url":"https://security.openstack.org/ossa/OSSA-2026-001.html","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8008-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22797","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-22797","description":"An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The external_oauth2_token middleware fails to sanitize incoming authentication headers before processing OAuth 2.0 tokens. By sending forged identity headers such as X-Is-Admin-Project, X-Roles, or X-User-Id, an authenticated attacker may escalate privileges or impersonate other users. All deployments using the external_oauth2_token middleware are affected.","status":"published","published":"2026-01-19T00:00:00Z","modified":"2026-09-10T12:05:03.991Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","level":"critical","assessor":"cna"},{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","level":"critical","assessor":"adp"}],"cwes":["CWE-290","CWE-290"],"updated_at":"2026-11-02T13:39:05.585774Z"}],"euvd":[{"id":"EUVD-2026-3202","description":"An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The external_oauth2_token middleware fails to sanitize incoming authentication headers before processing OAuth 2.0 tokens. By sending forged identity headers such as X-Is-Admin-Project, X-Roles, or X-User-Id, an authenticated attacker may escalate privileges or impersonate other users. All deployments using the external_oauth2_token middleware are affected.","status":"published","published":"2026-01-19T00:00:00Z","modified":"2026-09-10T12:05:03Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","level":"critical"}],"updated_at":"2026-11-02T17:28:25.275283Z"}],"ghsa":[{"id":"GHSA-4428-9rh9-r27g","title":"An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and...","description":"An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The external_oauth2_token middleware fails to sanitize incoming authentication headers before processing OAuth 2.0 tokens. By sending forged identity headers such as X-Is-Admin-Project, X-Roles, or X-User-Id, an authenticated attacker may escalate privileges or impersonate other users. All deployments using the external_oauth2_token middleware are affected.","status":"published","published":"2026-01-19T18:30:28Z","modified":"2026-06-30T03:36:27Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","level":"critical"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T15:09:04.668745Z"}],"nvd":[{"id":"CVE-2026-22797","description":"An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The external_oauth2_token middleware fails to sanitize incoming authentication headers before processing OAuth 2.0 tokens. By sending forged identity headers such as X-Is-Admin-Project, X-Roles, or X-User-Id, an authenticated attacker may escalate privileges or impersonate other users. All deployments using the external_oauth2_token middleware are affected.","status":"published","published":"2026-01-19T18:16:04.95Z","modified":"2026-09-10T13:17:43.557Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","level":"critical","assessor":"secondary"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T14:12:04.066712Z"}],"osv":[{"id":"DEBIAN-CVE-2026-22797","description":"An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The external_oauth2_token middleware fails to sanitize incoming authentication headers before processing OAuth 2.0 tokens. By sending forged identity headers such as X-Is-Admin-Project, X-Roles, or X-User-Id, an authenticated attacker may escalate privileges or impersonate other users. All deployments using the external_oauth2_token middleware are affected.","status":"published","published":"2026-01-19T18:16:04.95Z","modified":"2026-10-01T03:02:57.767669065Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","level":"critical"}],"updated_at":"2026-11-02T15:45:53.097669Z"},{"id":"UBUNTU-CVE-2026-22797","description":"An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The external_oauth2_token middleware fails to sanitize incoming authentication headers before processing OAuth 2.0 tokens. By sending forged identity headers such as X-Is-Admin-Project, X-Roles, or X-User-Id, an authenticated attacker may escalate privileges or impersonate other users. All deployments using the external_oauth2_token middleware are affected.","status":"published","published":"2026-01-19T18:16:00Z","modified":"2026-06-30T18:17:28.718847346Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","level":"critical"},{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","level":"critical"}],"updated_at":"2026-11-02T16:56:01.334185Z"},{"id":"DSA-6104-1","title":"python-keystonemiddleware - security update","status":"published","published":"2026-01-20T00:00:00Z","modified":"2026-01-20T22:30:00.862273Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"openSUSE-SU-2026:10070-1","title":"python-keystonemiddleware-doc-10.12.0-2.1 on GA media","description":"These are all security issues fixed in the python-keystonemiddleware-doc-10.12.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-01-19T00:00:00Z","modified":"2026-03-23T04:54:24.707058Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"USN-8008-1","title":"python-keystonemiddleware vulnerability","description":"Grzegorz Grasza discovered that the Keystone Middleware incorrectly\nsanitized authentication headers before processing OAuth 2.0 tokens. An\nattacker could possibly use this issue to escalate privileges or\nimpersonate other users.","status":"published","published":"2026-02-03T13:06:07Z","modified":"2026-06-30T18:15:15.980361196Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}