CVE-2026-22797: OpenStack Keystonemiddleware: authentication bypass via spoofed identity headers
CVE-2026-22797 affects OpenStack keystonemiddleware when the external_oauth2_token middleware is used, because it does not sanitize incoming authentication headers before processing OAuth 2.0 tokens. The record lists a CVSS 3.1 score of 9.9, rated critical. The sources consulted show no confirmed exploitation.
Overview
CVE-2026-22797 is a flaw in the external_oauth2_token middleware of OpenStack keystonemiddleware. According to the record, the middleware does not sanitize incoming authentication headers before it processes OAuth 2.0 tokens. The record classifies the weakness as CWE-290, Authentication Bypass by Spoofing.
Impact
- The record states that an authenticated attacker who sends forged identity headers may escalate privileges or impersonate other users.
- The recorded CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L, with a base score of 9.9 (critical).
- The vector marks the scope as changed (S:C). This suggests the impact may extend beyond the vulnerable component (inference from the vector).
Affected products and versions
- Product: OpenStack keystonemiddleware.
- According to the description, affected ranges are 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1.
- The record states that all deployments using the external_oauth2_token middleware are affected.
- The structured fixes field is empty. The boundaries above come from the description text, not from a fixes list.
- No fixed release is stated for the 10.8 line in the record.
Exploitation status
The record shows the CVE is not listed in CISA KEV. SSVC reports exploitation as none and automatable as no. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00652, with a percentile of 0.50614.
Remediation and mitigation
- Review the vendor and distribution advisories for the release train you run, and move to a release at or beyond the fixed boundary listed for it, such as 10.7.2, 10.9.1 or 10.12.1.
- For the 10.8 line, verify the fixed release with the vendor, because the record does not state one.
- If the external_oauth2_token middleware is not required, disable it until the patched release is deployed.
- Where the middleware is required, make sure that a trusted edge component strips or overwrites identity-related headers before requests reach the service.
- Rotate credentials and review role assignments for accounts that may have been abused.
Detection guidance
- Review gateway and service logs for requests that contain identity or role headers from untrusted sources.
- Look for administrative actions or actions performed as other users that do not match expected identity flows.
- Correlate authentication events with changes in project or role assignments.
Limitations of the available information
- The structured fixes list is empty, so fixed versions are taken from the description text only.
- The record does not describe the exact header handling code path or provide reproduction details, and this analysis does not include them.
- The Red Hat and oss-security references are cited in the record, but their contents are not part of the record and were not verified here.
- The source_status is shown as Deferred, and the record does not explain what that status means.
- The EPSS date in the record (2026-10-23) is later than the publication date, and its meaning is not explained.
Frequently asked questions
Which OpenStack keystonemiddleware versions are affected by CVE-2026-22797?
According to the description, the affected ranges are 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The record does not state a fixed release for the 10.8 line.
Is CVE-2026-22797 known to be actively exploited?
The record shows the CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.