OpenStack Admin Forgery: CVE-2026-22797 Lets Users ‘Ask’ for Root

**Executive Summary:** A critical privilege-escalation vulnerability (CVE-2026-22797) was found in OpenStack's keystonemiddleware external_oauth2_token middleware that fails to sanitize incoming authentication headers, allowing authenticated users to spoof headers (such as X-Is-Admin-Project, X-Roles, and X-User-Id) and potentially gain administrative privileges or impersonate other users; patches have been released across multiple OpenStack release branches and administrators are urged to apply them immediately.