OpenStack keystonemiddleware 10.512 Privilege Escalation via OAuth headers
CVE-2026-22797 Published on January 19, 2026

An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The external_oauth2_token middleware fails to sanitize incoming authentication headers before processing OAuth 2.0 tokens. By sending forged identity headers such as X-Is-Admin-Project, X-Roles, or X-User-Id, an authenticated attacker may escalate privileges or impersonate other users. All deployments using the external_oauth2_token middleware are affected.

NVD

Vulnerability Analysis

CVE-2026-22797 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and a small impact on availability.

Attack Vector:

NETWORK

Attack Complexity:

LOW

Privileges Required:

LOW

User Interaction:

NONE

Scope:

CHANGED

Confidentiality Impact:

HIGH

Integrity Impact:

HIGH

Availability Impact:

LOW

Weakness Type

Authentication Bypass by Spoofing

This attack-focused weakness is caused by improperly implemented authentication schemes that are subject to spoofing attacks.

Products Associated with CVE-2026-22797

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-22797 are published in these products:

OpenStack Keystonemiddleware

Red Hat Openshift

Red Hat Openstack

Affected Versions

OpenStack keystonemiddleware:

Version 10.5.0 and below 10.7.2 is affected.
Version 10.8.0 and below 10.9.1 is affected.
Version 10.10.0 and below 10.12.1 is affected.

Red Hat OpenShift Container Platform 4.17:

Version 1774266098 and below * is unaffected.

Red Hat OpenShift Container Platform 4.18:

Version 1773138063 and below * is unaffected.

Red Hat OpenShift Container Platform 4.19:

Version 1772477045 and below * is unaffected.

Red Hat OpenShift Container Platform 4.20:

Version 1772176749 and below * is unaffected.

Red Hat OpenShift Container Platform 4.21:

Version 1772029626 and below * is unaffected.

Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0: Red Hat OpenStack Platform 18.0:

Exploit Probability

EPSS

0.58%

Percentile

44.00%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.