CVE-2026-97404: [OSSA-2026-042] OpenStack Zaqar: Zaqar empty URL-Signatuheader bypasses authentication (CVE-2026-97404)
In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header. By sending a request with an empty URL-Signature header, an unauthenticated remote attacker who knows a target project's UUID may bypass both Keystone authentication and pre-signed URL verification, resulting in the ability to read, enumerate, create, and delete that project's queues, messages, claims, and subscriptions. By additionally claiming an administrative role, the attacker may also perform administrative operations, such as managing pools and flavors in adminmode deployments. Only deployments using the WSGI transport with an authentication strategy configured are affected; the websocket transport is not affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenStack Zaqarto a version that resolves this vulnerability.Fixed in 22.0.2
Event History
Frequently Asked Questions
Which deployments are affected?
Only OpenStack Zaqar deployments using the WSGI transport with an authentication strategy configured are affected. The websocket transport is not affected.
What does an attacker need to exploit this issue?
An unauthenticated remote attacker needs to know the target project's UUID and send a request with an empty URL-Signature header. No Keystone authentication or valid pre-signed URL is required.
What access could an attacker obtain?
An attacker can read, enumerate, create, and delete the target project's queues, messages, claims, and subscriptions. In admin_mode deployments, an attacker who additionally claims an administrative role can manage pools and flavors.
How can I determine whether my deployment is exposed?
Check whether Zaqar is running a version before 22.0.2, uses the WSGI transport, and has an authentication strategy configured. Deployments using only the websocket transport are not affected.