Executive brief
A vulnerability exists in OpenStack's identity management middleware, which is used to handle authentication for cloud services. An attacker with basic user access can bypass security controls by sending fake identity information in network requests. This could allow them to gain administrative privileges or impersonate other users, potentially leading to full control over the cloud environment and its data.
Technical details
A privilege escalation vulnerability exists in the external_oauth2_token middleware of OpenStack keystonemiddleware. The component fails to sanitize or clear incoming HTTP identity headers (such as X-Is-Admin-Project, X-Roles, and X-User-Id) before processing OAuth 2.0 tokens. Because the middleware only conditionally overwrites these headers when specific criteria are met, an authenticated attacker can provide forged headers that persist through the authentication chain. This allows for spoofing administrative status or other user identities. The issue is resolved by adding a call to remove_auth_headers() at the start of request processing in versions 10.7.2, 10.9.1, and 10.12.1.
Affected products
- OpenStack keystonemiddleware 10.5.0 to 10.7.1, 10.8.0 to 10.9.0, 10.10.0 to 10.12.0
- Red Hat Red Hat OpenShift Container Platform 4.17, 4.18, 4.19, 4.20, 4.21
Timeline
- 2026-01-15: disclosed: Original OSSA-2026-001 advisory published
- 2026-01-16: advisory: Errata 1 published correcting affected version ranges
- 2026-01-19: advisory: CVE published to NVD
References
- https://launchpad.net/bugs/2129018
- https://www.openwall.com/lists/oss-security/2026/01/16/9
- http://www.openwall.com/lists/oss-security/2026/01/15/1
- http://www.openwall.com/lists/oss-security/2026/01/16/2
- http://www.openwall.com/lists/oss-security/2026/01/16/3
- http://www.openwall.com/lists/oss-security/2026/01/16/9
- https://access.redhat.com/errata/RHSA-2026:3402