CVE-2026-22797

NameCVE-2026-22797
DescriptionAn issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The external_oauth2_token middleware fails to sanitize incoming authentication headers before processing OAuth 2.0 tokens. By sending forged identity headers such as X-Is-Admin-Project, X-Roles, or X-User-Id, an authenticated attacker may escalate privileges or impersonate other users. All deployments using the external_oauth2_token middleware are affected.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-6104-1
Debian Bugs1125680

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
python-keystonemiddleware (PTS)bullseye9.1.0-2fixed
bookworm10.1.0-4fixed
trixie10.9.0-2vulnerable
trixie (security)10.9.0-2+deb13u1fixed
forky, sid10.12.0-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
python-keystonemiddlewaresourcebullseye(not affected)
python-keystonemiddlewaresourcebookworm(not affected)
python-keystonemiddlewaresourcetrixie10.9.0-2+deb13u1DSA-6104-1
python-keystonemiddlewaresource(unstable)10.12.0-31125680

Notes

[bookworm] - python-keystonemiddleware <not-affected> (Vulnerable code not present)
[bullseye] - python-keystonemiddleware <not-affected> (Vulnerable code not present)
https://www.openwall.com/lists/oss-security/2026/01/15/1
https://bugs.launchpad.net/keystonemiddleware/+bug/2129018
Introduced with: https://github.com/openstack/keystonemiddleware/commit/de15a610e160defb367b224258498727384d10a8 (10.5.0)

Search for package or bug name: Reporting problems