Authentication bypass by spoofing in OpenStack keystonemiddleware
Priority MEDIUM 44CWE-290Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · Low
- Fix status
- Partial Red Hat: 5 fixed, 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-290.
Summary
An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The external_oauth2_token middleware fails to sanitize incoming authentication headers before processing OAuth 2.0 tokens. By sending forged identity headers such as X-Is-Admin-Project, X-Roles, or X-User-Id, an authenticated attacker may escalate privileges or impersonate other users. All deployments using the external_oauth2_token middleware are affected.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00652 51st percentileScored 2026-11-07
Fix Partial keystonemiddleware (OpenStack): 10.7.2, 10.9.1, 10.12.1Red Hat: 5 advisoriesRed Hat: 5 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| OpenStack | keystonemiddleware | 10.5.0 to before 10.7.2; 10.8.0 to before 10.9.1; 10.10.0 to before 10.12.1 | 10.7.2, 10.9.1, 10.12.1 | Patch available | CNA |
- keystonemiddleware VendorOpenStack Affected 10.5.0 to before 10.7.2; 10.8.0 to before 10.9.1; 10.10.0 to before 10.12.1 Fixed in 10.7.2, 10.9.1, 10.12.1 Patch available CNA
Remediation
- Fix · CNA keystonemiddleware (OpenStack) Fixed in 10.7.2, 10.9.1, 10.12.1
Red Hat 5 advisories
- RHSA-2026:5907 Released 2026-04-01 · Red Hat rating ImportantOpenShift Container Platform 4.17.52 bug fix and security update
- Red Hat OpenShift Container Platform 4.17 registry.redhat.io/openshift4/ose-cluster-kube-controller-manager-rhel9-operator, registry.redhat.io/openshift4/ose-ironic-rhel9, registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9
- RHSA-2026:5133 Released 2026-03-25 · Red Hat rating ImportantOpenShift Container Platform 4.18.36 bug fix and security update
- Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/ose-docker-registry-rhel9, registry.redhat.io/openshift4/ose-ironic-rhel9
- RHSA-2026:4434 Released 2026-03-18 · Red Hat rating ImportantOpenShift Container Platform 4.19.26 bug fix and security update
- Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9 +47
Show 2 more Red Hat advisories
- RHSA-2026:3855 Released 2026-03-11 · Red Hat rating ImportantOpenShift Container Platform 4.20.16 bug fix and security update
- Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9 +47
- RHSA-2026:3402 Released 2026-03-03 · Red Hat rating ImportantOpenShift Container Platform 4.21.4 bug fix and security update
- Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/ose-ironic-rhel9
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4.17 | Fixed | RHSA-2026:5907 |
| Red Hat OpenShift Container Platform 4.18 | Fixed | RHSA-2026:5133 |
| Red Hat OpenShift Container Platform 4.19 | Fixed | RHSA-2026:4434 |
| Red Hat OpenShift Container Platform 4.20 | Fixed | RHSA-2026:3855 |
| Red Hat OpenShift Container Platform 4.21 | Fixed | RHSA-2026:3402 |
Not affected: 9 products
- Red Hat OpenShift Container Platform 4.17
- Red Hat OpenShift Container Platform 4.18
- Red Hat OpenShift Container Platform 4.19
- Red Hat OpenShift Container Platform 4.20
- Red Hat OpenShift Container Platform 4.21
- Red Hat OpenStack Platform 13 (Queens)
- Red Hat OpenStack Platform 16.2
- Red Hat OpenStack Platform 17.1
- Red Hat OpenStack Platform 18.0
Timeline
- 2026-10-02 Threatist record created from CVE-2026-22797
- 2026-10-03 Alias added: GHSA-4428-9rh9-r27g
- 2026-10-08 EPSS moved to the 50th–90th percentile
- 2026-10-16 Affected versions changed · Red Hat
References
More OpenStack vulnerabilities
- TI-2026-78562 Incorrect authorization in OpenStack Manila share operations CVSS 3.1CRITICAL 9.9
- TI-2026-63467 Code injection in OpenStack Octavia CVSS 4.0CRITICAL 9.4
- TI-2017-13226 The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before… CVSS 3.1CRITICAL 9.8
- TI-2026-69629 OpenStack Mistral flaw lets users change other projects' resources CVSS 4.0HIGH 7.2
- TI-2026-69623 Command injection in OpenStack Mistral std.ssh_proxied action CVSS 4.0HIGH 8.7
- TI-2022-17779 Improper privilege management in OpenStack CVSS 3.1HIGH 8.8
Sources
- CVE-2026-22797 · CVE Program
- CVE-2026-22797 · NVD
- FIRST EPSS
- GHSA-4428-9rh9-r27g · GitHub Advisory Database · CC BY 4.0
- CVE-2026-22797 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences