This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] OpenStack keystonemiddleware fixes a critical vulnerability
OpenStack fixes a critical vulnerability in the keystonemiddleware package with versions 10.7.2, 10.9.1 and 10.12.1. Patches for manual application to individual OpenStack development branches can be found at [1]. Among the most common Linux distributions, for example Ubuntu versions 24.04 LTS (noble) and 25.10 (questing) are vulnerable [2]. In the Red Hat portfolio, OpenShift Container Platform 4 is affected [3]. Debian has released a fix for trixie (security) in version 10.9.0-2+deb13u1 and for forky and sid in version 10.12.0-3 [4]; the bullseye and bookworm releases are not affected. SUSE products are not affected by this vulnerability by default; a fix was released only for openSUSE Tumbleweed [5].
An authenticated remote attacker can elevate their privileges or impersonate another user by sending forged headers such as X-Is-Admin-Project, X-Roles or X-User-Id in modified HTTP requests [1]. All systems using the external_oauth2_token middleware within keystonemiddleware are affected.
The vulnerability is present in product:
- keystonemiddleware; >=10.5.0, <10.7.2; >=10.8.0, <10.9.1; >=10.10.0, <10.12.1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
More information:
- CVE-2026-22797 at cve.org, NVD
- CWE-290: Authentication Bypass by Spoofing at cwe.mitre.org
The vulnerability was publicly disclosed 19. 1. 2026.
Links
By CESNET, z.s.p.o. Michaela Ručková on 21. 1. 2026.