CVE-2026-22797
Published: 19 January 2026
Summary
CVE-2026-22797 is a critical-severity Authentication Bypass by Spoofing (CWE-290) vulnerability in Redhat (inferred from references). Its CVSS base score is 9.9 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 36.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-22797 is a high-severity vulnerability in OpenStack keystonemiddleware, affecting versions 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The external_oauth2_token middleware fails to sanitize incoming authentication headers prior to processing OAuth 2.0 tokens, enabling attackers to inject forged identity headers such as X-Is-Admin-Project, X-Roles, or X-User-Id. All deployments utilizing this middleware are vulnerable, with a CVSS v3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L) and mapped to CWE-290 (Authentication Bypass by Spoofing).
An authenticated attacker with low privileges can exploit this issue remotely over the network with low complexity and no user interaction required. By crafting and sending requests with manipulated headers during OAuth 2.0 token processing, the attacker can escalate their privileges or impersonate other users, potentially gaining high confidentiality, integrity, and limited availability impacts across a changed scope.
Advisories recommend upgrading to patched versions: 10.7.2, 10.9.1, or 10.12.1 and later. Detailed discussions and patches are available in the referenced sources, including the Launchpad bug report at https://launchpad.net/bugs/2129018 and oss-security mailing list announcements at https://www.openwall.com/lists/oss-security/2026/01/16/9, http://www.openwall.com/lists/oss-security/2026/01/15/1, http://www.openwall.com/lists/oss-security/2026/01/16/2, and http://www.openwall.com/lists/oss-security/2026/01/16/3.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3202
Vulnerability details
An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The external_oauth2_token middleware fails to sanitize incoming authentication headers before processing OAuth 2.0 tokens. By sending forged…
more
identity headers such as X-Is-Admin-Project, X-Roles, or X-User-Id, an authenticated attacker may escalate privileges or impersonate other users. All deployments using the external_oauth2_token middleware are affected.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability in OpenStack Keystone middleware allows low-privileged authenticated attackers to forge authentication headers (e.g., X-Roles, X-User-Id), directly enabling exploitation of the remote authentication service for privilege escalation and user impersonation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of incoming authentication headers to prevent exploitation via forged X-Is-Admin-Project, X-Roles, or X-User-Id headers in the external_oauth2_token middleware.
Mandates timely identification, reporting, and patching of software flaws like the keystonemiddleware sanitization failure affecting versions 10.5 through 10.12.
Ensures mechanisms for unique identification and authentication of users, mitigating impersonation and privilege escalation from unsanitized OAuth 2.0 token processing.