Is CVE-2026-22797 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-22797 being exploited in the wild.

How severe is CVE-2026-22797?

Critical severity, with a CVSS score of 9.9, published 19 January 2026.

Which products and versions are affected?

OpenStack Keystonemiddleware 10.5.0 to 10.7.1, 10.8.0 to 10.9.0, 10.10.0 to 10.12.0.

Is there a fix for CVE-2026-22797?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-22797 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-22797?

Check whether you run OpenStack Keystonemiddleware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-22797: OpenStack keystonemiddleware privilege escalation via identity header spoofing

CVE-2026-22797 · Severity: critical · CVSS 9.9 · Published 2026-01-19

A vulnerability exists in OpenStack's identity management middleware, which is used to handle authentication for cloud services. An attacker with basic user access can bypass security controls by sending fake identity information in network requests. This could allow them to gain administrative privileges or impersonate other users, potentially leading to full control over the cloud environment and its data.

Vendors: OpenStack.

Quick answers

Is CVE-2026-22797 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-22797 being exploited in the wild.
How severe is CVE-2026-22797?: Critical severity, with a CVSS score of 9.9, published 19 January 2026.
Which products and versions are affected?: OpenStack Keystonemiddleware 10.5.0 to 10.7.1, 10.8.0 to 10.9.0, 10.10.0 to 10.12.0.
Is there a fix for CVE-2026-22797?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-22797 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-22797?: Check whether you run OpenStack Keystonemiddleware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A privilege escalation vulnerability exists in the external_oauth2_token middleware of OpenStack keystonemiddleware. The component fails to sanitize or clear incoming HTTP identity headers (such as X-Is-Admin-Project, X-Roles, and X-User-Id) before processing OAuth 2.0 tokens. Because the middleware only conditionally overwrites these headers when specific criteria are met, an authenticated attacker can provide forged headers that persist through the authentication chain. This allows for spoofing administrative status or other user identities. The issue is resolved by adding a call to remove_auth_headers() at the start of request processing in versions 10.7.2, 10.9.1, and 10.12.1.

Affected products

OpenStack keystonemiddleware 10.5.0 to 10.7.1, 10.8.0 to 10.9.0, 10.10.0 to 10.12.0
Red Hat Red Hat OpenShift Container Platform 4.17, 4.18, 4.19, 4.20, 4.21

Timeline

2026-01-15: disclosed: Original OSSA-2026-001 advisory published
2026-01-16: advisory: Errata 1 published correcting affected version ranges
2026-01-19: advisory: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.