What is the CVSS score of CVE-2026-22797?

CVE-2026-22797 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L. EPSS exploitation probability: 0.1%.

Which versions of OpenStack are affected by CVE-2026-22797?

Organizations using OpenStack keystonemiddleware 10.5 face critical risk from CVE-2026-22797 rated CVSS 9.9.. A patch is available.

How to fix or mitigate CVE-2026-22797?

Within 24 hours: Identify all affected systems running OpenStack keystonemiddleware 10.5 and apply vendor patches immediately. Monitor vendor channels for patch availability.

OpenStack CVE-2026-22797

CRITICAL

Authentication Bypass by Spoofing (CWE-290)

2026-01-19 cve@mitre.org

Authentication Bypass

9.9

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

SUSE

CRITICAL

qualitative

Red Hat

9.9 HIGH

qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Patch released

Apr 09, 2026 - 20:30 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 19, 2026 - 18:16 nvd

CRITICAL 9.9

DescriptionCVE.org

An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The external_oauth2_token middleware fails to sanitize incoming authentication headers before processing OAuth 2.0 tokens. By sending forged identity headers such as X-Is-Admin-Project, X-Roles, or X-User-Id, an authenticated attacker may escalate privileges or impersonate other users. All deployments using the external_oauth2_token middleware are affected.

AnalysisAI

OpenStack keystonemiddleware 10.5 through 10.9 has an authentication spoofing vulnerability (CVSS 9.9) allowing attackers to bypass Keystone token validation and access any OpenStack service as any user.

Technical ContextAI

A flaw in keystonemiddleware versions 10.5-10.9 allows CWE-290 authentication spoofing by manipulating request headers to bypass token validation. This affects all OpenStack services that rely on keystonemiddleware for authentication.