CVE-2026-22797

CRITICAL

An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The external_oauth2_token middleware fa...

Affects 1 product across 3 vendors.

CVSS 3.19.9
EPSS0.7%
Percentile50th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, low privileges required, no user interaction needed, can impact systems beyond the vulnerable component, full confidentiality impact, full integrity impact.
CWE Weakness Definitions
CWE-290: CWE-290
Related Attack Patterns (CAPEC)
CAPEC-59 Session Credential Falsification through Prediction
via CWE-290
CAPEC-60 Reusing Session IDs (aka Session Replay)
via CWE-290
CAPEC-459 Creating a Rogue Certification Authority Certificate
via CWE-290
CAPEC-476 Signature Spoofing by Misrepresentation
via CWE-290
CAPEC-667 Bluetooth Impersonation AttackS (BIAS)
via CWE-290
Show all 10

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A critical vulnerability in OpenStack keystonemiddleware allows authenticated attackers to escalate privileges by forging identity headers.

BSID: BS-2026-GLOBAL-277012-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2026-22797?
A critical vulnerability in OpenStack keystonemiddleware allows authenticated attackers to escalate privileges by forging identity headers.
What is the CVSS score for CVE-2026-22797?
CVE-2026-22797 has CVSS 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L. EPSS: 0.7%.
Is CVE-2026-22797 actively exploited?
No confirmed active exploitation of CVE-2026-22797 as of 2026-09-25.
How do I remediate CVE-2026-22797?
Priority: IMMEDIATE.
What systems are affected by CVE-2026-22797?
CVE-2026-22797 affects Openstack Keystonemiddleware; Processing; Project.
Vulnerability Details
CVE IDCVE-2026-22797
BSIDBS-2026-GLOBAL-277012-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Published2026-01-19
Last Modified2026-09-10
ICS Relevance0%
Weakness (CWE)
CWE-290
SourceNVD
Official Description

An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The external_oauth2_token middleware fails to sanitize incoming authentication headers before processing OAuth 2.0 tokens. By sending forged identity headers such as X-Is-Admin-Project, X-Roles, or X-User-Id, an authenticated attacker may escalate privileges or impersonate other users. All deployments using the external_oauth2_token middleware are affected.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The external_oauth2_token middleware fails to sanitize incoming authentication headers, enabling attackers to inject headers like X-Is-Admin-Project, X-Roles, or X-User-Id to manipulate user permissions.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductAffected Versions
Openstack Keystonemiddleware ≥ 10.5.0, < 10.7.2 ≥ 10.8.0, < 10.9.1 ≥ 10.10.0, < 10.12.1
Processing — —
Project — —
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 269 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash089a4d86b5c24872e5b841a52844f5baea2e073f8bf4ac23256a68028d53bb79815133fa61109bc94e5de855f2370dc38634c1191798e9dba263772f29a09cd5
Related CVEs affecting Openstack
CVE-2025-59823 9.9 Project Gardener implements the automated management and operation of Kuberne... CVE-2020-26943 9.9 An issue was discovered in OpenStack blazar-dashboard before 1.3.1, 2.0.0, an... CVE-2017-16613 9.8 An issue was discovered in middleware.py in OpenStack Swauth through 1.2.0 wh... CVE-2012-4406 9.8 OpenStack Object Storage (swift) before 1.7.0 uses the loads function in the ... CVE-2016-4972 9.8 OpenStack Murano before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), Murano...
View all Openstack CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.9 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →