← לוח פגיעויות

CVE-2026-22797

קריטית 9.9

תיאור (מקור, אנגלית)

An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The external_oauth2_token middleware fails to sanitize incoming authentication headers before processing OAuth 2.0 tokens. By sending forged identity headers such as X-Is-Admin-Project, X-Roles, or X-User-Id, an authenticated attacker may escalate privileges or impersonate other users. All deployments using the external_oauth2_token middleware are affected.

מדדים

CVSS 3.1
9.9 (CRITICAL) מקור הציון: CNA CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
EPSS — סבירות ניצול
1% (אחוזון 000) נכון ל-26/7/2026
CWE
CWE-290

קישורים