PT-2026-3233 · Openstack+2 · Openstack+2

Grzegorz Grasza · Publicado 2026-01-01 · Atualizado 2026-02-06 · CVE-2026-22797

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions OpenStack (affected versions not specified)

Description An issue exists in OpenStack’s keystonemiddleware component that could allow for privilege escalation or impersonation. An authenticated attacker may be able to elevate their privileges or assume the identity of another user by forging identity headers, such as X-Is-Admin-Project, X-Roles, or X-User-Id, within external OAuth2 tokens. The issue allows users to ‘ask’ for root access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Authentication Bypass by Spoofing

Enumeração de Fraquezas

CWE-290

Identificadores relacionados

CVE-2026-22797

OPENSUSE-SU-2026:10070-1

USN-8008-1

Produtos afetados

Linuxmint

Openstack

Ubuntu

Referências · 27

• http://openwall.com/lists/oss-security/2026/01/16/9 · Nota
• https://openwall.com/lists/oss-security/2026/01/15/1 · Nota
• https://twitter.com/Karma_X_Inc/status/2012000996411547886 · Publicação no Twitter
• https://osv.dev/vulnerability/USN-8008-1 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2026-22797 · Nota de Segurança
• https://twitter.com/TheHackerWire/status/2013325765816053784 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/2013320410666877363 · Publicação no Twitter
• https://security.openstack.org/ossa/OSSA-2026-001.html · Nota
• https://launchpad.net/bugs/2129018 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-22797 · Nota de Segurança
• https://twitter.com/oss_security/status/2011968309218959535 · Publicação no Twitter
• https://ubuntu.com/security/CVE-2026-22797 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2026/01/15/1 · Nota
• https://twitter.com/CrowdCyber_Com/status/2012495724575850611 · Publicação no Twitter
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-22797 · Aviso do Fabricante