keystonemiddleware: From CVEorg collector
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| OpenStack | keystonemiddleware | unaffected |
|
No data.
No data.
No data available yet.
| Source | ID | Title |
|---|---|---|
Debian DSA |
DSA-6104-1 | python-keystonemiddleware security update |
Ubuntu USN |
USN-8008-1 | Keystone Middleware vulnerability |
No CVSS v4.0
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.652% probability within 30 days)
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
| Type | Values Removed | Values Added |
|---|---|---|
| Title | keystonemiddleware: From CVEorg collector | |
| References |
| |
| Metrics |
threat_severity
|
threat_severity
|
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Openstack
Openstack keystonemiddleware |
|
| Weaknesses | CWE-290 | |
| CPEs | cpe:2.3:a:openstack:keystonemiddleware:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Openstack
Openstack keystonemiddleware |
|
| Metrics |
cvssV3_1
|
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The external_oauth2_token middleware fails to sanitize incoming authentication headers before processing OAuth 2.0 tokens. By sending forged identity headers such as X-Is-Admin-Project, X-Roles, or X-User-Id, an authenticated attacker may escalate privileges or impersonate other users. All deployments using the external_oauth2_token middleware are affected. | |
| References |
|
View source · Bugzilla · JSON
OpenCVE enrichment
Updated: Apr 18, 2026, 4:00 PM
Debian DSA
Ubuntu USN