An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The external_oauth2_token middleware fails to sanitize incoming authentication headers before processing OAuth 2.0 tokens. By sending forged identity headers such as X-Is-Admin-Project, X-Roles, or X-User-Id, an authenticated attacker may escalate privileges or impersonate other users. All deployments using the external_oauth2_token middleware are affected.
Advisories
Source ID Title
Debian DSA Debian DSA DSA-6104-1 python-keystonemiddleware security update
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

History

Wed, 21 Jan 2026 03:15:00 +0900

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}


Tue, 20 Jan 2026 09:15:00 +0900

Type Values Removed Values Added
Title keystonemiddleware: From CVEorg collector
References
Metrics threat_severity

None

threat_severity

Critical


Tue, 20 Jan 2026 04:30:00 +0900


Tue, 20 Jan 2026 02:45:00 +0900

Type Values Removed Values Added
First Time appeared Openstack
Openstack keystonemiddleware
Weaknesses CWE-290
CPEs cpe:2.3:a:openstack:keystonemiddleware:*:*:*:*:*:*:*:*
Vendors & Products Openstack
Openstack keystonemiddleware
Metrics cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L'}


Tue, 20 Jan 2026 02:30:00 +0900

Type Values Removed Values Added
Description An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The external_oauth2_token middleware fails to sanitize incoming authentication headers before processing OAuth 2.0 tokens. By sending forged identity headers such as X-Is-Admin-Project, X-Roles, or X-User-Id, an authenticated attacker may escalate privileges or impersonate other users. All deployments using the external_oauth2_token middleware are affected.
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-01-20T17:28:09.348Z

Reserved: 2026-01-09T00:00:00.000Z

Link: CVE-2026-22797

cve-icon Vulnrichment

Updated: 2026-01-19T18:08:40.994Z

cve-icon NVD

Status : Received

Published: 2026-01-19T18:16:04.950

Modified: 2026-01-19T19:16:03.727

Link: CVE-2026-22797

cve-icon Redhat

Severity : Critical

Publid Date: 2026-01-19T00:00:00Z

Links: CVE-2026-22797 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses