CVE-2026-22797: Openstack Keystonemiddleware

Critical severity, CVSS 9.9. EPSS: 0.7% chance of exploitation in the next 30 days.

An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The external_oauth2_token middleware fails to sanitize incoming authentication headers before processing OAuth 2.0 tokens. By sending forged identity headers such as X-Is-Admin-Project, X-Roles, or X-User-Id, an authenticated attacker may escalate privileges or impersonate other users. All deployments using the external_oauth2_token middleware are affected.

Affected products

• Openstack Keystonemiddleware: from 10.5.0, before 10.7.2 (fixed in 10.7.2); from 10.8.0, before 10.9.1 (fixed in 10.9.1); from 10.10.0, before 10.12.1 (fixed in 10.12.1)
• Red Hat Red Hat Openshift Container Platform 4.17: before 1774266098 (fixed in 1774266098)
• Red Hat Red Hat Openshift Container Platform 4.18: before 1773138063 (fixed in 1773138063)
• Red Hat Red Hat Openshift Container Platform 4.19: before 1772477045 (fixed in 1772477045)
• Red Hat Red Hat Openshift Container Platform 4.20: before 1772176749 (fixed in 1772176749)
• Red Hat Red Hat Openshift Container Platform 4.21: before 1772029626 (fixed in 1772029626)
• Red Hat Red Hat Openstack Platform 13 Queens
• Red Hat Red Hat Openstack Platform 16.2
• Red Hat Red Hat Openstack Platform 17.1
• Red Hat Red Hat Openstack Platform 18.0

Published 2026-01-19. Last modified 2026-09-10.