Summary
Grzegorz Grasza discovered that the Keystone Middleware incorrectly
sanitized authentication headers before processing OAuth 2.0 tokens. An
attacker could possibly use this issue to escalate privileges or
impersonate other users.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 24.04 LTS 24.04:LTS | python-keystonemiddleware | 10.6.0-0ubuntu1.1 |
| Ubuntu · 25.10 | python-keystonemiddleware | 10.12.0-0ubuntu1.1 |
References
-
report
https://ubuntu.com/security/CVE-2026-22797