The vulnerability CVE-2026-22797 in OpenStack keystonemiddleware affects the external_oauth2_token middleware, which does not sanitize authentication headers before processing OAuth 2.0 tokens. This flaw allows an authenticated attacker to send forged identity headers (e.g., X-Is-Admin-Project, X-Roles, X-User-Id) to escalate privileges or impersonate other users. The affected versions include 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. Red Hat advisories confirm the issue and provide patches. The CVSS v3.1 score is 9.9 (critical), indicating high impact on confidentiality and integrity with low attack complexity and no user interaction required.

An authenticated attacker can exploit this vulnerability to escalate privileges or impersonate other users by forging authentication headers. This compromises confidentiality and integrity of the system and can lead to unauthorized access to sensitive resources. The availability impact is low. The vulnerability affects all deployments using the external_oauth2_token middleware in the specified versions.

A fix is available. Users should upgrade to patched versions: 10.7.2 or later for the 10.5–10.7 series, 10.9.1 or later for the 10.9 series, and 10.12.1 or later for the 10.10–10.12 series. Red Hat has issued advisories and updates for affected products. Applying these official patches is the recommended mitigation. No vendor advisory states that no action is required or that the issue is already mitigated without patching.