https://seclists.org/oss-sec/2026/q3/921: [OSSA-2026-042] OpenStack Zaqar: Zaqar empty URL-Signatuheader bypasses authentication (CVE-2026-97404)

Q: Which deployments are affected?

Only Zaqar deployments using the WSGI transport with an authentication strategy configured are affected. The websocket transport is not affected.

Q: What does an attacker need to exploit this issue?

An unauthenticated remote attacker needs to know the UUID of the target project and send a request with a URL-Signature header whose value is empty.

Q: What could an attacker access or change?

An attacker can read, enumerate, create, and delete the target project's queues, messages, claims, and subscriptions. In admin_mode deployments, an attacker that additionally claims an administrative role may manage pools and flavors.

Q: Which Zaqar versions require remediation?

Affected versions are 1.0.0 through versions before 20.1.2, 21.0.0 through versions before 21.0.2, and 22.0.0 through versions before 22.0.2.

Published Sep 24, 2026

Updated

Affected Software

1 affected component

Openstack Zaqar>=1.0.0<20.1.2, >=21.0.0<21.0.2, >=22.0.0<22.0.2

Frequently Asked Questions

Which deployments are affected?

Only Zaqar deployments using the WSGI transport with an authentication strategy configured are affected. The websocket transport is not affected.

What does an attacker need to exploit this issue?

An unauthenticated remote attacker needs to know the UUID of the target project and send a request with a URL-Signature header whose value is empty.

What could an attacker access or change?

An attacker can read, enumerate, create, and delete the target project's queues, messages, claims, and subscriptions. In admin_mode deployments, an attacker that additionally claims an administrative role may manage pools and flavors.

Which Zaqar versions require remediation?

Affected versions are 1.0.0 through versions before 20.1.2, 21.0.0 through versions before 21.0.2, and 22.0.0 through versions before 22.0.2.