THREAT OPS › Threat News › [NVD] CVE-2026-22797 (CRITICAL 9.9) — An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The external_oauth2_token middleware fails to sanitize incoming authentication headers before processing OAuth 2.0 tokens.
[NVD] CVE-2026-22797 (CRITICAL 9.9) — An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The external_oauth2_token middleware fails to sanitize incoming authentication headers before processing OAuth 2.0 tokens.
CVE-2026-22797 CVSS: 9.9 CRITICAL Published: 2026-01-19T18:16:04.950
An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The external_oauth2_token middleware fails to sanitize incoming authentication headers before processing OAuth 2.0 tokens. By sending forged identity headers such as X-Is-A
Indicators of compromise
- CVE-2026-22797cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-22797