CVE-2026-107363: [OSSA-2026-043] OpenStack Zaqar: Zaqar WebSocket project substitution allows cross-project queue access (CVE-2026-107363) errata 1
In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. An authenticated user with a valid token for one project may substitute another project's UUID to enumerate, inspect, create, or delete queues belonging to that project, resulting in unauthorized disclosure, modification, or loss of queue data. Only deployments using the WebSocket transport with Keystone authentication are affected.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Only OpenStack Zaqar deployments that use the WebSocket transport with Keystone authentication are affected. Zaqar versions before 23.0.1 are vulnerable.
What does an attacker need to exploit this issue?
An attacker needs to be an authenticated user with a valid Keystone token for any project. They can then substitute another project's UUID in subsequent WebSocket requests.
What could an attacker do after exploiting the flaw?
They may enumerate, inspect, create, or delete queues belonging to another project. This can expose queue data and allow unauthorized modification or loss of that data.