Openstack Keystonemiddleware vulnerabilities

4 known vulnerabilities affecting openstack/keystonemiddleware.

Total CVEs
4
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL1HIGH1MEDIUM2

Vulnerabilities

Page 1 of 1
CVE-2026-22797CRITICALCVSS 9.9≥ 10.5.0, < 10.7.2≥ 10.8.0, < 10.9.1+1 more2026-01-19
CVE-2026-22797 [CRITICAL] CWE-290 CVE-2026-22797: An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10 An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The external_oauth2_token middleware fails to sanitize incoming authentication headers before processing OAuth 2.0 tokens. By sending forged identity headers such as X-Is-Admin-Project, X-Rol
cvelistv5nvd
CVE-2015-7546HIGHCVSS 7.5≥ 1.5.0, ≤ 1.5.3≥ 1.6.0, ≤ 2.3.22016-02-03
CVE-2015-7546 [HIGH] CWE-522 CVE-2015-7546: The identity service in OpenStack Identity (Keystone) before 2015.1.3 (Kilo) and 8.0.x before 8.0.2 The identity service in OpenStack Identity (Keystone) before 2015.1.3 (Kilo) and 8.0.x before 8.0.2 (Liberty) and keystonemiddleware (formerly python-keystoneclient) before 1.5.4 (Kilo) and Liberty before 2.3.3 does not properly invalidate authorization tokens when using the PKI or PKIZ token providers, which allows remote authenticated users to bypass i
nvd
CVE-2015-1852MEDIUMCVSS 4.3≤ 1.5.02015-04-17
CVE-2015-1852 [MEDIUM] CVE-2015-1852: The s3_token middleware in OpenStack keystonemiddleware before 1.6.0 and python-keystoneclient befor The s3_token middleware in OpenStack keystonemiddleware before 1.6.0 and python-keystoneclient before 1.4.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate, a different vulnerabil
nvd
CVE-2014-7144MEDIUMCVSS 4.3v1.0.0v1.1.0+1 more2014-10-02
CVE-2014-7144 [MEDIUM] CWE-310 CVE-2014-7144: OpenStack keystonemiddleware (formerly python-keystoneclient) 0.x before 0.11.0 and 1.x before 1.2.0 OpenStack keystonemiddleware (formerly python-keystoneclient) 0.x before 0.11.0 and 1.x before 1.2.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate.
nvd