by Kastro CVE-2026-22797
OpenStack keystonemiddleware — An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 1…
Description · from the CVE record
An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The external_oauth2_token middleware fails to sanitize incoming authentication headers before processing OAuth 2.0 tokens. By sending forged identity headers such as X-Is-Admin-Project, X-Roles, or X-User-Id, an authenticated attacker may escalate privileges or impersonate other users. All deployments using the external_oauth2_token middleware are affected.
Affected
ProductAffectedFixed inSource
keystonemiddleware10.5.0 – < 10.7.210.7.2CNA
keystonemiddleware10.8.0 – < 10.9.110.9.1CNA
keystonemiddleware10.10.0 – < 10.12.110.12.1CNA
Red Hat OpenShift Container Platform 4.17see advisory1774266098redhat-SADP
Red Hat OpenShift Container Platform 4.18see advisory1773138063redhat-SADP
Red Hat OpenShift Container Platform 4.19see advisory1772477045redhat-SADP
Red Hat OpenShift Container Platform 4.20see advisory1772176749redhat-SADP
Red Hat OpenShift Container Platform 4.21see advisory1772029626redhat-SADP
Red Hat OpenStack Platform 13 (Queens)see advisory–redhat-SADP
Red Hat OpenStack Platform 13 (Queens)see advisory–redhat-SADP
Red Hat OpenStack Platform 13 (Queens)see advisory–redhat-SADP
Red Hat OpenStack Platform 13 (Queens)see advisory–redhat-SADP
Scores by source
mitre (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
redhat-SADP (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total