OpenStack Admin Forgery: CVE-2026-22797 Lets Users ‘Ask’ for Root

OpenStack has fixed a privilege escalation flaw, CVE-2026-22797, that could let a standard authenticated user trick the system into granting administrative powers or impersonating other users by forging identity headers. The issue lies in keystonemiddleware, which handles authentication tokens for OpenStack services, and specifically affects deployments using the external_oauth2_token middleware, where unsanitised headers could be trusted as truth.

The advisory notes that by injecting forged headers such as X-Is-Admin-Project, X-Roles, or X-User-Id, an attacker may escalate privileges or impersonate others, because the middleware only conditionally set certain headers, leaving spoofed values intact when conditions were not met.

The vulnerability affects multiple Keystonemiddleware versions, including >=10.0.0 <10.7.2, >=10.8.0 <10.9.1, and >=10.10.0 <10.12.1, and all deployments using the external_oauth2_token middleware are affected, according to the advisory.

Grzegorz Grasza of Red Hat reported the flaw, and the OpenStack team has released patches across Caracal (2024.1), Dalmatian (2024.2), Epoxy (2025.1), Flamingo (2025.2), and Gazpacho (2026.1); administrators are urged to apply them promptly so identity verification is performed correctly rather than trusting incoming headers. 16 January 2026