Skip to content
Fencer Intel
critical 9.9

CVE-2026-22797 json

An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.…

published 9mo ago modified last mo. also EUVD-2026-3202

cvss
9.9
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 51%
public exploits
0
none known

Summary

An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The external_oauth2_token middleware fails to sanitize incoming authentication headers before processing OAuth 2.0 tokens. By sending forged identity headers such as X-Is-Admin-Project, X-Roles, or X-User-Id, an authenticated attacker may escalate privileges or impersonate other users. All deployments using the external_oauth2_token middleware are affected.

Patch / fix

  • OpenStack keystonemiddleware 10.7.2, 10.9.1, 10.12.1
  • Red Hat Red Hat OpenShift Container Platform 4.17 1774266098
  • Red Hat Red Hat OpenShift Container Platform 4.18 1773138063
  • Red Hat Red Hat OpenShift Container Platform 4.19 1772477045
  • Red Hat Red Hat OpenShift Container Platform 4.20 1772176749
  • Red Hat Red Hat OpenShift Container Platform 4.21 1772029626
  • python-keystonemiddleware Debian 13 10.9.0-2+deb13u1
  • python-keystonemiddleware Debian 14 10.12.0-3

debian advisories DEBIAN-CVE-2026-22797

  • python-keystonemiddleware Ubuntu 24.04 LTS 10.6.0-0ubuntu1.1
  • python-keystonemiddleware Ubuntu 25.10 10.12.0-0ubuntu1.1

ubuntu advisories UBUNTU-CVE-2026-22797

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • python-keystonemiddleware openSUSE Tumbleweed 10.12.0-2.1

opensuse advisories openSUSE-SU-2026:10070-1

Is CVE-2026-22797 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-22797 updated cvss 9.9

keystonemiddleware: OpenStack keystonemiddleware: Privilege escalation and user impersonation via forged authentication headers

  • Red Hat OpenShift Container Platform 4 openshift4/ose-ironic-agent-rhel9
    affected: workaround, no fix available
  • Red Hat OpenShift Container Platform 4.17 openshift4 1774266098
    fixed: vendor fix RHSA-2026:5907
  • Red Hat OpenShift Container Platform 4.18 openshift4 1773138063
    fixed: vendor fix RHSA-2026:5133
  • Red Hat OpenShift Container Platform 4.19 openshift4 1772477045
    fixed: vendor fix RHSA-2026:4434
  • Red Hat OpenShift Container Platform 4.20 openshift4 1772176749
    fixed: vendor fix RHSA-2026:3855
  • Red Hat OpenShift Container Platform 4.21 openshift4 1772029626
    fixed: vendor fix RHSA-2026:3402
  • Red Hat OpenShift Container Platform 4.17 openshift4 1774266017, openshift4 1774266052, openshift4 1774266298, openshift4 1774276883, openshift4 1774276940, openshift4 1774276952, +177 more Red Hat OpenShift Container Platform 4.18 openshift4 1772677866, openshift4 1772677872, openshift4 1772677873, openshift4 1772732160, openshift4 1772732165, openshift4 1772732194, +51 more Red Hat OpenShift Container Platform 4.19 openshift4 1772149183, openshift4 1772149306, openshift4 1772149330, openshift4 1772149345, openshift4 1772150646, openshift4 1772150660, +179 more Red Hat OpenShift Container Platform 4.20 openshift4 1772138382, openshift4 1772138401, openshift4 1772138403, openshift4 1772138413, openshift4 1772138414, openshift4 1772138417, +181 more Red Hat OpenShift Container Platform 4.21 openshift4 1771930318, openshift4 1771964450, openshift4 1771964453, openshift4 1771964455, openshift4 1771964460, openshift4 1771964481, +176 more Red Hat OpenStack Platform 13 (Queens) rhosp13/openstack-zaqar, rhosp13/openstack-ec2-api, rhosp13/openstack-horizon, rhosp13/openstack-tempest, rhosp13/openstack-aodh-api, rhosp13/openstack-collectd, +83 more
    +3 more products
    Red Hat OpenStack Platform 16.2 rhosp-rhel8/openstack-aodh-api, rhosp-rhel8/openstack-heat-all, rhosp-rhel8/openstack-heat-api, rhosp-rhel8/openstack-keystone, rhosp-rhel8/openstack-nova-api, rhosp-rhel8/openstack-aodh-base, +78 more Red Hat OpenStack Platform 17.1 rhosp-rhel9/openstack-aodh-api, rhosp-rhel9/openstack-heat-all, rhosp-rhel9/openstack-heat-api, rhosp-rhel9/openstack-keystone, rhosp-rhel9/openstack-nova-api, rhosp-rhel8/openstack-nova-base, +68 more Red Hat OpenStack Platform 18.0 rhoso/openstack-aodh-api-rhel9, rhoso/openstack-heat-api-rhel9, rhoso/openstack-keystone-rhel9, rhoso/openstack-nova-api-rhel9, rhoso/openstack-aodh-base-rhel9, rhoso/openstack-heat-base-rhel9, +59 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
9mo ago

Exploit prediction

0.65% chance of exploitation in the next 30 days, higher than 51% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
CISA ADP 3.1 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Affected products

  • OpenStack keystonemiddleware
  • Red Hat Red Hat OpenShift Container Platform 4.17
  • Red Hat Red Hat OpenShift Container Platform 4.18
  • Red Hat Red Hat OpenShift Container Platform 4.19
  • Red Hat Red Hat OpenShift Container Platform 4.20
  • Red Hat Red Hat OpenShift Container Platform 4.21
  • Red Hat Red Hat OpenStack Platform 13 (Queens)
  • Red Hat Red Hat OpenStack Platform 16.2
  • Red Hat Red Hat OpenStack Platform 17.1
  • Red Hat Red Hat OpenStack Platform 18.0

Classification

Weakness
  • CWE-290 Authentication Bypass by Spoofing

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.