keystonemiddleware vulnerabilities

2 known vulnerabilities in keystonemiddleware from OpenStack. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.3 High severity

  keystonemiddleware: Incorrect Authorization

  CVE-2026-115642Oct 30, 2026OpenStack

  In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-restricted application credential may bypass those restrictions resulting in elevation of privileges.

• 9.9 Critical severity

  keystonemiddleware: Authentication Bypass by Spoofing

  CVE-2026-22797Jan 19, 2026OpenStack

  An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The external_oauth2_token middleware fails to sanitize incoming authentication headers before processi