CVE-2026-22797: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-22797 is a privilege escalation vulnerability in OpenStack keystonemiddleware's external_oauth2_token middleware, classified as Authentication Bypass by Spoofing (CWE-290). Discovered by Grzegorz Grasza of Red Hat and disclosed on January 15, 2026 (OSSA-2026-001), it affects keystonemiddleware versions 10.5.0–10.7.x (before 10.7.2), 10.8.0–10.9.x (before 10.9.1), and 10.10.0–10.12.x (before 10.12.1). The vulnerability carries a CVSS v3.1 base score of 9.9 (Critical), assigned by MITRE (OSS-Security Advisory, Red Hat CVE).

The root cause is that the external_oauth2_token middleware only conditionally sets certain identity headers (e.g., X-Is-Admin-Project was only set when the token had admin privileges), leaving attacker-supplied values intact when those conditions were not met — effectively failing to strip or sanitize incoming authentication headers before processing OAuth 2.0 tokens. This is classified as CWE-290 (Authentication Bypass by Spoofing). An authenticated attacker can inject forged HTTP headers such as X-Is-Admin-Project, X-Roles, or X-User-Id into requests, which the middleware then trusts and passes downstream to OpenStack services. The fix adds a call to remove_auth_headers() at the start of request processing, mirroring the behavior of the main auth_token middleware. The vulnerable code was introduced in keystonemiddleware 10.5.0 during the OpenStack 2024.1 (Caracal) development cycle (OSS-Security Advisory, OSS-Security Original).

A low-privileged authenticated attacker can exploit this vulnerability to escalate privileges to administrative level or impersonate arbitrary users across all OpenStack services protected by the affected middleware. This results in high confidentiality and integrity impact — attackers can access sensitive cloud resources, modify configurations, and perform unauthorized administrative actions — with low availability impact. All deployments using the external_oauth2_token middleware are affected, making the scope of impact potentially broad across multi-tenant OpenStack cloud environments (OSS-Security Advisory, Red Hat CVE).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (Red Hat CVE). The EPSS score is approximately 0.00105 (0.1%), indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the low attack complexity and the requirement of only a low-privilege authenticated account make it relatively straightforward to exploit in environments using the affected middleware.

1. Reconnaissance: Identify OpenStack deployments using the external_oauth2_token middleware by reviewing API endpoint configurations or probing service responses. Confirm the keystonemiddleware version is in the affected range (10.5.0–10.7.1, 10.8.0–10.9.0, or 10.10.0–10.12.0).
2. Obtain valid credentials: Acquire any low-privilege OAuth 2.0 token for the target OpenStack environment (e.g., via a standard user account).
3. Craft malicious request: Construct an HTTP request to an OpenStack API endpoint, including a valid Authorization: Bearer <token> header alongside forged identity headers such as:
   • X-Is-Admin-Project: True
   • X-Roles: admin
   • X-User-Id: <target-user-uuid>
4. Submit the request: Send the crafted request to the target OpenStack API. The external_oauth2_token middleware processes the OAuth token but does not strip the forged headers, passing them downstream.
5. Achieve privilege escalation or impersonation: The downstream OpenStack service trusts the unsanitized headers, granting the attacker administrative privileges or treating the request as originating from the impersonated user, enabling unauthorized resource access or administrative actions (OSS-Security Advisory).

• Network: HTTP requests to OpenStack API endpoints containing both a valid Authorization: Bearer token and unexpected identity headers (X-Is-Admin-Project, X-Roles, X-User-Id) from non-administrative source IPs.
• Logs: OpenStack API access logs showing low-privilege user tokens associated with admin-level operations or actions attributed to other user IDs; Keystone middleware logs showing requests with identity headers not matching the authenticated token's actual roles.
• Behavioral: Unexpected administrative actions (e.g., project creation, quota modification, user management) performed by accounts that should not have admin privileges; access to resources belonging to other tenants or users by accounts without explicit authorization.

Upgrade OpenStack keystonemiddleware to the following patched versions based on your current branch: 10.7.2 (2024.1/caracal), 10.9.1 (2024.2/dalmatian), or 10.12.1 (2025.1/epoxy and later). Patches are available via OpenDev review at https://review.opendev.org/973499 through 973494 for each respective branch. As an interim measure, deployments should restrict network access to OpenStack API endpoints to trusted sources only, and monitor authentication logs for suspicious header manipulation. There is no known configuration-based workaround that fully mitigates the vulnerability without patching (OSS-Security Advisory, Red Hat CVE).

The OpenStack Vulnerability Management Team (Jeremy Stanley) published the official advisory OSSA-2026-001 on January 15, 2026, with an errata correction on January 16 to narrow the affected version range from 10.0.0 to 10.5.0 after community input from Salvatore Bonaccorso (Debian) identified the precise commit introducing the vulnerable code (OSS-Security Errata). The EGI CSIRT published a dedicated advisory highlighting the critical nature of the vulnerability for research and academic cloud infrastructure (OSS-Security Original). Cyble included the vulnerability in their weekly vulnerability roundup, and security news outlets such as SecurityOnline.info covered it under the headline framing it as an "admin forgery" issue. Debian and Ubuntu both issued distribution-level security advisories for the python-keystonemiddleware package.