Skip to content
Fencer Vulns
critical 9.9

CVE-2026-22797 json

An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.…

published 2026-01-19 9 mo ago modified 2026-09-10 59 d ago also EUVD-2026-3202

cvss
9.9
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 51%
public exploits
0
none known

Summary

An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The external_oauth2_token middleware fails to sanitize incoming authentication headers before processing OAuth 2.0 tokens. By sending forged identity headers such as X-Is-Admin-Project, X-Roles, or X-User-Id, an authenticated attacker may escalate privileges or impersonate other users. All deployments using the external_oauth2_token middleware are affected.

Patch / fix

  • OpenStack keystonemiddleware 10.7.2, 10.9.1, 10.12.1
  • Red Hat Red Hat OpenShift Container Platform 4.17 1774266098
  • Red Hat Red Hat OpenShift Container Platform 4.18 1773138063
  • Red Hat Red Hat OpenShift Container Platform 4.19 1772477045
  • Red Hat Red Hat OpenShift Container Platform 4.20 1772176749
  • Red Hat Red Hat OpenShift Container Platform 4.21 1772029626
  • python-keystonemiddleware Debian 13 10.9.0-2+deb13u1
  • python-keystonemiddleware Debian 14 10.12.0-3

debian advisories DEBIAN-CVE-2026-22797

  • python-keystonemiddleware Ubuntu 24.04 LTS 10.6.0-0ubuntu1.1
  • python-keystonemiddleware Ubuntu 25.10 10.12.0-0ubuntu1.1

ubuntu advisories UBUNTU-CVE-2026-22797

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • python-keystonemiddleware openSUSE Tumbleweed 10.12.0-2.1

opensuse advisories openSUSE-SU-2026:10070-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-22797 updated cvss 9.9

keystonemiddleware: OpenStack keystonemiddleware: Privilege escalation and user impersonation via forged authentication headers

  • Red Hat OpenShift Container Platform 4 openshift4/ose-ironic-agent-rhel9
    affected: workaround, no fix available
  • Red Hat OpenShift Container Platform 4.17 openshift4 1774266098
    fixed: vendor fix RHSA-2026:5907
  • Red Hat OpenShift Container Platform 4.18 openshift4 1773138063
    fixed: vendor fix RHSA-2026:5133
  • Red Hat OpenShift Container Platform 4.19 openshift4 1772477045
    fixed: vendor fix RHSA-2026:4434
  • Red Hat OpenShift Container Platform 4.20 openshift4 1772176749
    fixed: vendor fix RHSA-2026:3855
  • Red Hat OpenShift Container Platform 4.21 openshift4 1772029626
    fixed: vendor fix RHSA-2026:3402
  • Red Hat OpenShift Container Platform 4.17 openshift4 1774266017, openshift4 1774266052, openshift4 1774266298, openshift4 1774276883, openshift4 1774276940, openshift4 1774276952, +177 more Red Hat OpenShift Container Platform 4.18 openshift4 1772677866, openshift4 1772677872, openshift4 1772677873, openshift4 1772732160, openshift4 1772732165, openshift4 1772732194, +51 more Red Hat OpenShift Container Platform 4.19 openshift4 1772149183, openshift4 1772149306, openshift4 1772149330, openshift4 1772149345, openshift4 1772150646, openshift4 1772150660, +179 more Red Hat OpenShift Container Platform 4.20 openshift4 1772138382, openshift4 1772138401, openshift4 1772138403, openshift4 1772138413, openshift4 1772138414, openshift4 1772138417, +181 more Red Hat OpenShift Container Platform 4.21 openshift4 1771930318, openshift4 1771964450, openshift4 1771964453, openshift4 1771964455, openshift4 1771964460, openshift4 1771964481, +176 more Red Hat OpenStack Platform 13 (Queens) rhosp13/openstack-zaqar, rhosp13/openstack-ec2-api, rhosp13/openstack-horizon, rhosp13/openstack-tempest, rhosp13/openstack-aodh-api, rhosp13/openstack-collectd, +83 more
    +3 more products
    Red Hat OpenStack Platform 16.2 rhosp-rhel8/openstack-aodh-api, rhosp-rhel8/openstack-heat-all, rhosp-rhel8/openstack-heat-api, rhosp-rhel8/openstack-keystone, rhosp-rhel8/openstack-nova-api, rhosp-rhel8/openstack-aodh-base, +78 more Red Hat OpenStack Platform 17.1 rhosp-rhel9/openstack-aodh-api, rhosp-rhel9/openstack-heat-all, rhosp-rhel9/openstack-heat-api, rhosp-rhel9/openstack-keystone, rhosp-rhel9/openstack-nova-api, rhosp-rhel8/openstack-nova-base, +68 more Red Hat OpenStack Platform 18.0 rhoso/openstack-aodh-api-rhel9, rhoso/openstack-heat-api-rhel9, rhoso/openstack-keystone-rhel9, rhoso/openstack-nova-api-rhel9, rhoso/openstack-aodh-base-rhel9, rhoso/openstack-heat-base-rhel9, +59 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
9 mo ago

Exploit prediction

0.65% chance of exploitation in the next 30 days, higher than 51% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
CISA ADP 3.1 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Affected products

  • OpenStack keystonemiddleware
  • Red Hat Red Hat OpenShift Container Platform 4.17
  • Red Hat Red Hat OpenShift Container Platform 4.18
  • Red Hat Red Hat OpenShift Container Platform 4.19
  • Red Hat Red Hat OpenShift Container Platform 4.20
  • Red Hat Red Hat OpenShift Container Platform 4.21
  • Red Hat Red Hat OpenStack Platform 13 (Queens)
  • Red Hat Red Hat OpenStack Platform 16.2
  • Red Hat Red Hat OpenStack Platform 17.1
  • Red Hat Red Hat OpenStack Platform 18.0

Classification

Weakness
  • CWE-290 Authentication Bypass by Spoofing

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.