CVE-2026-22797
Fixed in a distro release EPSS <1%CVSS 9.9
An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The external_oauth2_token middleware fails to sanitize incoming authentication headers before processing OAuth 2.0 tokens. By sending forged identity headers such as X-Is-Admin-Project, X-Roles, or X-User-Id, an authenticated attacker may escalate privileges or impersonate other users. All deployments using the external_oauth2_token middleware are affected.
Products: OpenStack keystonemiddleware, Red Hat OpenShift Container Platform 4.17, Red Hat OpenShift Container Platform 4.18, Red Hat OpenShift Container Platform 4.19, Red Hat OpenShift Container Platform 4.20, Red Hat OpenShift Container Platform 4.21, Red Hat OpenStack Platform 13 (Queens), Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1, Red Hat OpenStack Platform 18.0
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 13 | python-keystonemiddleware | 10.9.0-2+deb13u1 |
| Debian 14 | python-keystonemiddleware | 10.12.0-3 |
| Ubuntu 24.04 LTS | python-keystonemiddleware | 10.6.0-0ubuntu1.1 |
| Ubuntu 25.10 | python-keystonemiddleware | 10.12.0-0ubuntu1.1 |
| openSUSE Tumbleweed | python-keystonemiddleware | 10.12.0-2.1 |