An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The external_oauth2_token middleware fails to sanitize incoming authentication headers before processing OAuth 2.0 tokens. By sending forged identity headers such as X-Is-Admin-Project, X-Roles, or X-User-Id, an authenticated attacker may escalate privileges or impersonate other users. All deployments using the external_oauth2_token middleware are affected.
Advisories
Source ID Title
Debian DSA Debian DSA DSA-6104-1 python-keystonemiddleware security update
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

History

Tue, 20 Jan 2026 18:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}


Tue, 20 Jan 2026 00:15:00 +0000

Type Values Removed Values Added
Title keystonemiddleware: From CVEorg collector
References
Metrics threat_severity

None

threat_severity

Critical


Mon, 19 Jan 2026 19:30:00 +0000


Mon, 19 Jan 2026 17:45:00 +0000

Type Values Removed Values Added
First Time appeared Openstack
Openstack keystonemiddleware
Weaknesses CWE-290
CPEs cpe:2.3:a:openstack:keystonemiddleware:*:*:*:*:*:*:*:*
Vendors & Products Openstack
Openstack keystonemiddleware
Metrics cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L'}


Mon, 19 Jan 2026 17:30:00 +0000

Type Values Removed Values Added
Description An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The external_oauth2_token middleware fails to sanitize incoming authentication headers before processing OAuth 2.0 tokens. By sending forged identity headers such as X-Is-Admin-Project, X-Roles, or X-User-Id, an authenticated attacker may escalate privileges or impersonate other users. All deployments using the external_oauth2_token middleware are affected.
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-01-20T17:28:09.348Z

Reserved: 2026-01-09T00:00:00.000Z

Link: CVE-2026-22797

cve-icon Vulnrichment

Updated: 2026-01-19T18:08:40.994Z

cve-icon NVD

Status : Received

Published: 2026-01-19T18:16:04.950

Modified: 2026-01-19T19:16:03.727

Link: CVE-2026-22797

cve-icon Redhat

Severity : Critical

Publid Date: 2026-01-19T00:00:00Z

Links: CVE-2026-22797 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses