CVE-2026-22797: Critical OpenStack keystonemiddleware Flaw Enables Identity Spoofing & Full Admin Privilege Escalation

CVE-2026-22797 – OpenStack keystonemiddleware

Vulnerability type: Privilege Escalation / Identity Spoofing
Component: keystonemiddleware (external_oauth2_token filter)
Severity: Critical
CVSS v3.1 score: 9.9 (Critical)
Attack vector: Network (remote, over HTTP/HTTPS)
Authentication required: Yes (any valid token)
User interaction: None
Impact: Full identity impersonation, admin privilege escalation, unauthorized access to OpenStack services
Exploitability: High
Public exploit / PoC: No fully weaponized public exploit; exploitation is straightforward and reproducible in lab environments for educational and defensive testing

Executive summary

CVE-2026-22797 is a serious flaw in OpenStack’s keystonemiddleware when it is configured to trust external OAuth2 identity providers. Because of improper handling of HTTP identity headers, a user with any valid token can manipulate request headers to appear as another user or even an administrator.

In simple terms:
the system trusted identity information sent by the user before properly cleaning it up and re-building it from a verified token. That mistake allows identity spoofing and privilege escalation.

If exploited in production, this vulnerability can allow:

Non-admin users to gain admin-level access
Impersonation of other tenants or service accounts
Unauthorized creation, deletion, or modification of OpenStack resources
Full compromise of cloud control-plane services

What exactly is broken

The external_oauth2_token middleware is designed to:

Remove all user-supplied identity headers
Validate an OAuth2 token using an external authorization server
Populate trusted identity headers based only on token introspection

The flaw is that step 1 was not reliably enforced.

Under certain request paths, keystonemiddleware failed to fully clear pre-existing identity headers such as:

X-User-Id
X-User-Name
X-Project-Id
X-Roles
X-Is-Admin-Project

As a result, client-controlled headers could survive and be consumed by downstream OpenStack services. Those services assume identity headers are trustworthy because they normally come from Keystone, not from the user.

This breaks the core trust boundary of OpenStack authentication.

Who is affected

You are vulnerable if all of the following are true:

You run OpenStack services that use keystonemiddleware
The external_oauth2_token filter is enabled
Your keystonemiddleware version is older than the fixed releases
External clients can reach your API endpoints

This affects both public and private clouds if external OAuth2 integration is used.

How this can be exploited (educational)

The following is for defensive understanding and security testing only.

High-level attack flow

Attacker obtains any valid OAuth2 token (low-privilege user is enough)
Attacker sends an API request to an OpenStack service
In the same request, attacker injects forged identity headers
Vulnerable middleware fails to remove those headers
Downstream service trusts the forged identity
Attacker gains elevated privileges or impersonates another user

Example malicious request

GET /v2.1/servers HTTP/1.1
Host: openstack-api.example.com
Authorization: Bearer eyJhbGciOi...
X-User-Id: admin-user-id
X-User-Name: admin
X-Roles: admin
X-Is-Admin-Project: True

If the system is vulnerable, the request may be processed as if it came from an administrator, even though the token itself is not admin-scoped.

Impact scenarios

Creation or deletion of virtual machines across tenants
Access to sensitive metadata and secrets
Modification of network security groups
Abuse of service accounts
Cloud-wide denial of service or persistence mechanisms

In multi-tenant environments, this is especially dangerous because it breaks tenant isolation.

Detection and monitoring guidance

Primary log sources to monitor

Keystone / keystonemiddleware logs
API gateway or reverse proxy access logs
Nova, Cinder, Neutron, Glance audit logs
Centralized OpenStack audit logs

What suspicious activity looks like

Requests containing identity headers from external clients
Mismatch between token identity and request headers
Sudden admin actions from previously low-privilege users
Admin-only operations without corresponding admin tokens
Identity headers present before Keystone authentication completes

Detection rules

1. Header-based detection

Trigger alerts when client-originated requests contain any of the following headers:

X-Roles
X-User-Id
X-Project-Id
X-Is-Admin-Project

These headers should never be accepted from untrusted clients.

2. Splunk detection rule

index=openstack
| where like(http_request_headers, "%X-Roles%")
   OR like(http_request_headers, "%X-User-Id%")
   OR like(http_request_headers, "%X-Is-Admin-Project%")
| table _time, src_ip, user_agent, http_request_headers, request_uri

3. Elastic / KQL rule

http.request.headers.X-Roles:* OR
http.request.headers.X-User-Id:* OR
http.request.headers.X-Is-Admin-Project:*

Add a condition to exclude trusted internal service IP ranges.

4. Correlation rule (strong signal)

Alert when:

Token user ID ≠ X-User-Id
Token roles ≠ X-Roles
Non-admin token performs admin-only actions

This correlation is extremely effective and low-noise.

5. Example Sigma-style rule

title: OpenStack Identity Header Spoofing Attempt
status: high
description: Detects client-supplied OpenStack identity headers which may indicate exploitation of CVE-2026-22797
logsource:
  product: webserver
detection:
  selection:
    http.request.headers.X-Roles: "*"
    http.request.headers.X-User-Id: "*"
  condition: selection
level: critical

Mitigation

If you cannot upgrade immediately:

Strip all OpenStack identity headers at the API gateway or load balancer
Block external clients from sending X-* identity headers
Restrict access to OpenStack APIs by network segmentation
Increase audit logging temporarily

These are stop-gap measures only.

Official fix (mandatory)

Upgrade keystonemiddleware to a fixed version.
The fix ensures all identity headers are forcibly removed before token processing.

Official OpenStack patch / advisory

OpenStack Security Advisory – OSSA-2026-001
https://security.openstack.org/ossa/OSSA-2026-001.html

Upgrade to one of the following or newer:

keystonemiddleware 10.7.2
keystonemiddleware 10.9.1
keystonemiddleware 10.12.1

Always follow your distribution’s official OpenStack packages where applicable.

MITRE ATT&CK mapping

TA0004 – Privilege Escalation
T1068 – Exploitation for Privilege Escalation
T1078 – Valid Accounts

CWE mapping

CWE-285 – Improper Authorization
CWE-290 – Authentication Bypass by Spoofing

Final Takeaway

CVE-2026-22797 is a trust-boundary failure in OpenStack authentication.
If left unpatched, it allows any authenticated user to become anyone inside your cloud.

This is a patch-now vulnerability, not one to accept risk on.