CVE catalog
CVE-2026-22797
Keystone Middleware vulnerability
- Severity
- Critical · CVSS 9.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.65% · Oct 25, 2026
An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The external_oauth2_token middleware fails to sanitize incoming authentication headers before processing OAuth 2.0 tokens. By sending forged identity headers such as X-Is-Admin-Project, X-Roles, or X-User-Id, an authenticated attacker may escalate privileges or impersonate other users. All deployments using the external_oauth2_token middleware are affected.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | python-keystonemiddleware | sid | 13.0.1-4 | fixed |
| Debian | python-keystonemiddleware | forky | 13.0.1-4 | fixed |
| Debian | python-keystonemiddleware | trixie | 10.9.0-2+deb13u1 | fixed |
| Debian | python-keystonemiddleware | trixie-security | 10.9.0-2+deb13u1 | fixed |
| Debian | python-keystonemiddleware | bookworm | 10.1.0-4 | not affected |
| Ubuntu | python-keystonemiddleware | noble | 10.6.0-0ubuntu1.1 | fixed |
| Ubuntu | python-keystonemiddleware-doc | noble | 10.6.0-0ubuntu1.1 | fixed |
| Ubuntu | python3-keystonemiddleware | noble | 10.6.0-0ubuntu1.1 | fixed |
| Ubuntu | python-keystonemiddleware | 24.04 | 10.4.1-0ubuntu1 | vulnerable |
| Ubuntu | python-keystonemiddleware | 24.04 | 10.5.0-0ubuntu1 | vulnerable |
| Ubuntu | python-keystonemiddleware | 24.04 | 10.5.0-0ubuntu2 | vulnerable |
| Ubuntu | python-keystonemiddleware | 24.04 | 10.6.0-0ubuntu1 | vulnerable |
| Ubuntu | python-keystonemiddleware | 24.04 | 10.6.0-0ubuntu1.1 | fixed |
| Ubuntu | python-keystonemiddleware | 25.10 | 10.9.0-0ubuntu1 | vulnerable |
| Ubuntu | python-keystonemiddleware | 25.10 | 10.11.0-0ubuntu1 | vulnerable |
| Ubuntu | python-keystonemiddleware | 25.10 | 10.12.0-0ubuntu1 | vulnerable |
| Ubuntu | python-keystonemiddleware | 25.10 | 10.12.0-0ubuntu1.1 | fixed |
| Ubuntu | python-keystonemiddleware | 24.04 | 10.4.1-0ubuntu1 | vulnerable |
| Ubuntu | python-keystonemiddleware | 24.04 | 10.5.0-0ubuntu1 | vulnerable |
| Ubuntu | python-keystonemiddleware | 24.04 | 10.5.0-0ubuntu2 | vulnerable |
| Ubuntu | python-keystonemiddleware | 24.04 | 10.6.0-0ubuntu1 | vulnerable |
| Ubuntu | python-keystonemiddleware | 24.04 | 10.6.0-0ubuntu1.1 | fixed |
| Ubuntu | python-keystonemiddleware | 25.10 | 10.9.0-0ubuntu1 | vulnerable |
| Ubuntu | python-keystonemiddleware | 25.10 | 10.11.0-0ubuntu1 | vulnerable |
| Ubuntu | python-keystonemiddleware | 25.10 | 10.12.0-0ubuntu1 | vulnerable |
| Ubuntu | python-keystonemiddleware | 25.10 | 10.12.0-0ubuntu1.1 | fixed |
| Opensuse | python-keystonemiddleware | tumbleweed | 10.12.0-2.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | python-keystonemiddleware | source | sid | 10.12.0-3 | not yet assigned | Not reported | [1125680] |
| Debian | python-keystonemiddleware | source | forky | 10.12.0-3 | not yet assigned | Not reported | [1125680] |
| Debian | python-keystonemiddleware | source | trixie | 10.9.0-2+deb13u1 | not yet assigned | Not reported | [1125680] |
| Debian | python-keystonemiddleware | source | bookworm | Not affected | unimportant | Not reported | [1125680] |
| Ubuntu | python-keystonemiddleware | deb | noble | 10.6.0-0ubuntu1.1 | Not reported | Not reported | Not reported |
| Ubuntu | python-keystonemiddleware-doc | deb | noble | 10.6.0-0ubuntu1.1 | Not reported | Not reported | Not reported |
| Ubuntu | python3-keystonemiddleware | deb | noble | 10.6.0-0ubuntu1.1 | Not reported | Not reported | Not reported |
| Ubuntu | python-keystonemiddleware | deb | 24.04 | 10.6.0-0ubuntu1.1 | Not reported | UBUNTU-CVE-2026-22797 | Not reported |
| Ubuntu | python-keystonemiddleware | deb | 25.10 | 10.12.0-0ubuntu1.1 | Not reported | UBUNTU-CVE-2026-22797 | Not reported |
| Ubuntu | python-keystonemiddleware | deb | 24.04 | 10.6.0-0ubuntu1.1 | Not reported | USN-8008-1 | Not reported |
| Ubuntu | python-keystonemiddleware | deb | 25.10 | 10.12.0-0ubuntu1.1 | Not reported | USN-8008-1 | Not reported |
| Opensuse | python-keystonemiddleware | rpm | tumbleweed | 10.12.0-2.1 | Not reported | OPENSUSE-SU-2026:10070-1 | Not reported |
OpenFactory catalog packages
[openSUSE Tumbleweed]
- [python313-keystonemiddleware]Unknown
Source package: [python-keystonemiddleware]
Details (1)
13.0.0-1.1· noarch · tumbleweedUnknown · Fixed:
10.12.0-2.1Version impact unknown
usn · python-keystonemiddleware · opensuse · tumbleweed
- [python314-keystonemiddleware]Unknown
Source package: [python-keystonemiddleware]
Details (1)
13.0.0-1.1· noarch · tumbleweedUnknown · Fixed:
10.12.0-2.1Version impact unknown
usn · python-keystonemiddleware · opensuse · tumbleweed
- [python-keystonemiddleware-doc]Unknown
Source package: [python-keystonemiddleware]
Details (1)
13.0.0-1.1· noarch · tumbleweedUnknown · Fixed:
10.12.0-2.1Version impact unknown
usn · python-keystonemiddleware · opensuse · tumbleweed
[Debian 12 (Bookworm)]
- [python3-keystonemiddleware]Not affected
Source package: [python-keystonemiddleware]
Details (2)
10.1.0-4· all · bookwormNot affected
usn · python-keystonemiddleware · debian · bookworm
10.1.0-4· all · bookwormNot affected
usn · python-keystonemiddleware · debian · bookworm
- [python-keystonemiddleware-doc]Not affected
Source package: [python-keystonemiddleware]
Details (2)
10.1.0-4· all · bookwormNot affected
usn · python-keystonemiddleware · debian · bookworm
10.1.0-4· all · bookwormNot affected
usn · python-keystonemiddleware · debian · bookworm
[Debian 13 (Trixie)]
- [python3-keystonemiddleware]Fixed
Source package: [python-keystonemiddleware]
Details (4)
10.9.0-2+deb13u1· all · trixieFixed · Fixed:
10.9.0-2+deb13u1usn · python-keystonemiddleware · debian · 13
10.9.0-2+deb13u1· all · trixieFixed · Fixed:
10.9.0-2+deb13u1usn · python-keystonemiddleware · debian · 13
10.9.0-2+deb13u1· all · trixie-securityFixed · Fixed:
10.9.0-2+deb13u1usn · python-keystonemiddleware · debian · 13
10.9.0-2+deb13u1· all · trixie-securityFixed · Fixed:
10.9.0-2+deb13u1usn · python-keystonemiddleware · debian · 13
Source package: [python-keystonemiddleware]
Details (4)
10.9.0-2+deb13u1· all · trixieFixed · Fixed:
10.9.0-2+deb13u1usn · python-keystonemiddleware · debian · 13
10.9.0-2+deb13u1· all · trixieFixed · Fixed:
10.9.0-2+deb13u1usn · python-keystonemiddleware · debian · 13
10.9.0-2+deb13u1· all · trixie-securityFixed · Fixed:
10.9.0-2+deb13u1usn · python-keystonemiddleware · debian · 13
10.9.0-2+deb13u1· all · trixie-securityFixed · Fixed:
10.9.0-2+deb13u1usn · python-keystonemiddleware · debian · 13
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_10070-1.json]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-22797]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-22797]
- [https://osv.dev/vulnerability/DSA-6104-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2026-22797]
- [https://osv.dev/vulnerability/USN-8008-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:10070-1]
- [https://security-tracker.debian.org/tracker/CVE-2026-22797]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22797.json]
- [https://ubuntu.com/security/notices/USN-8008-1]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0149.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]