PT-2026-3233 · Openstack+2 · Openstack+2

Grzegorz Grasza · Published 2026-01-01 · Updated 2026-02-06 · CVE-2026-22797

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions OpenStack (affected versions not specified)

Description An issue exists in OpenStack’s keystonemiddleware component that could allow for privilege escalation or impersonation. An authenticated attacker may be able to elevate their privileges or assume the identity of another user by forging identity headers, such as X-Is-Admin-Project, X-Roles, or X-User-Id, within external OAuth2 tokens. The issue allows users to ‘ask’ for root access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2026-22797

OPENSUSE-SU-2026:10070-1

USN-8008-1

Affected Products

Linuxmint

Openstack

Ubuntu

References · 27

• https://osv.dev/vulnerability/USN-8008-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-22797 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-22797 · Security Note
• https://ubuntu.com/security/CVE-2026-22797 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-22797 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-22797 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10070-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-22797 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8008-1 · Vendor Advisory
• http://openwall.com/lists/oss-security/2026/01/16/9 · Note
• https://openwall.com/lists/oss-security/2026/01/15/1 · Note
• https://twitter.com/Karma_X_Inc/status/2012000996411547886 · Twitter Post
• https://twitter.com/TheHackerWire/status/2013325765816053784 · Twitter Post
• https://twitter.com/CveFindCom/status/2013320410666877363 · Twitter Post
• https://security.openstack.org/ossa/OSSA-2026-001.html · Note