===================================================================================== =====================================================================================
:Date: October 07, 2026 :CVE: CVE-2026-107363
Affects ~~~~~~~ - Zaqar: >=1.0.0 <20.1.3, >=21.0.0 <21.0.3, >=22.0.0 <22.0.3, ==23.0.0
Description ~~~~~~~~~~~ Chen YuXiang from the Institute of Computing Technology, Chinese Academy of Sciences reported a vulnerability in Zaqar's WebSocket transport. An authenticated remote attacker who knows a target project's UUID may substitute it in subsequent WebSocket frames to enumerate, inspect, create, or delete queues belonging to that project. This may result in unauthorized disclosure, modification, or loss of queue data. Only deployments using the WebSocket transport with Keystone authentication are affected.
Errata ~~~~~~ CVE-2026-107363 has been assigned for this vulnerability.
Patches ~~~~~~~ - https://review.opendev.org/1009254 (2025.1/epoxy) - https://review.opendev.org/1009253 (2025.2/flamingo) - https://review.opendev.org/1009252 (2026.1/gazpacho) - https://review.opendev.org/1009251 (2026.2/hibiscus) - https://review.opendev.org/1009250 (2027.1/indri (development))
Credits ~~~~~~~ References ~~~~~~~~~~ - https://launchpad.net/bugs/2161402 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-107363
OSSA History ~~~~~~~~~~~~ - 2026-10-07 - Errata 1 - 2026-10-07 - Original Version
-- Goutham Pacha Ravi OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html
On 10/7/26 10:59 AM, Goutham Pacha Ravi wrote: ===================================================================================== =====================================================================================
:Date: October 07, 2026 :CVE: CVE-2026-pending
Affects ~~~~~~~ - Zaqar: >=1.0.0 <20.1.3, >=21.0.0 <21.0.3, >=22.0.0 <22.0.3, ==23.0.0
Description ~~~~~~~~~~~ Chen YuXiang from the Institute of Computing Technology, Chinese Academy of Sciences reported a vulnerability in Zaqar's WebSocket transport. An authenticated remote attacker who knows a target project's UUID may substitute it in subsequent WebSocket frames to enumerate, inspect, create, or delete queues belonging to that project. This may result in unauthorized disclosure, modification, or loss of queue data. Only deployments using the WebSocket transport with Keystone authentication are affected.
Patches ~~~~~~~ - https://review.opendev.org/1009254 (2025.1/epoxy) - https://review.opendev.org/1009253 (2025.2/flamingo) - https://review.opendev.org/1009252 (2026.1/gazpacho) - https://review.opendev.org/1009251 (2026.2/hibiscus) - https://review.opendev.org/1009250 (2027.1/indri (development))
Credits ~~~~~~~ References ~~~~~~~~~~ - https://launchpad.net/bugs/2161402 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-pending
Notes ~~~~~ - A CVE identifier was requested from MITRE for this vulnerability on 2026-10-06. The CVE will be added to this advisory by errata once assigned.
-- Goutham Pacha Ravi OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html
In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. An authenticated user with a valid token for one project may substitute another project's UUID to enumerate, inspect, create, or delete queues belonging to that project, resulting in unauthorized disclosure, modification, or loss of queue data. Only deployments using the WebSocket transport with Keystone authentication are affected.
===================================================================================== =====================================================================================
:Date: October 07, 2026 :CVE: CVE-2026-pending
Affects ~~~~~~~ - Zaqar: >=1.0.0 <20.1.3, >=21.0.0 <21.0.3, >=22.0.0 <22.0.3, ==23.0.0
Description ~~~~~~~~~~~ Chen YuXiang from the Institute of Computing Technology, Chinese Academy of Sciences reported a vulnerability in Zaqar's WebSocket transport. An authenticated remote attacker who knows a target project's UUID may substitute it in subsequent WebSocket frames to enumerate, inspect, create, or delete queues belonging to that project. This may result in unauthorized disclosure, modification, or loss of queue data. Only deployments using the WebSocket transport with Keystone authentication are affected.
Patches ~~~~~~~ - https://review.opendev.org/1009254 (2025.1/epoxy) - https://review.opendev.org/1009253 (2025.2/flamingo) - https://review.opendev.org/1009252 (2026.1/gazpacho) - https://review.opendev.org/1009251 (2026.2/hibiscus) - https://review.opendev.org/1009250 (2027.1/indri (development))
Credits ~~~~~~~ References ~~~~~~~~~~ - https://launchpad.net/bugs/2161402 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-pending
Notes ~~~~~ - A CVE identifier was requested from MITRE for this vulnerability on 2026-10-06. The CVE will be added to this advisory by errata once assigned.
-- Goutham Pacha Ravi OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html
======================================================================= OSSA-2026-042: Zaqar empty URL-Signature header bypasses authentication =======================================================================
:Date: September 24, 2026 :CVE: CVE-2026-97404
Affects ~~~~~~~ - Zaqar: >=1.0.0 <20.1.2, >=21.0.0 <21.0.2, >=22.0.0 <22.0.2
Description ~~~~~~~~~~~ pple, an independent security researcher, reported that Zaqar's WSGI transport mishandles an empty URL-Signature header: a request carrying the header with an empty value bypasses both Keystone authentication and pre-signed URL verification. An unauthenticated remote attacker who knows a target project's UUID can then read, enumerate, create, and delete that project's queues, messages, claims, and subscriptions. By additionally claiming an administrative role, the attacker may also perform administrative operations, such as managing pools and flavors in adminmode deployments. Only deployments using the WSGI transport with an authentication strategy configured are affected; the websocket transport is not affected.
Patches ~~~~~~~ - https://review.opendev.org/1007162 (2025.1/epoxy) - https://review.opendev.org/1007161 (2025.2/flamingo) - https://review.opendev.org/1007160 (2026.1/gazpacho) - https://review.opendev.org/1007159 (2026.2/hibiscus) - https://review.opendev.org/1007158 (2027.1/indri (development))
Credits ~~~~~~~ - pple from Independent (CVE-2026-97404)
References ~~~~~~~~~~ - https://launchpad.net/bugs/2164987 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97404
Notes ~~~~~ - This issue is distinct from the EXTRA-SPEC header bypass in OSSA-2026-029; the fix for that issue removed the EXTRA-SPEC branch but left the empty-value handling of the URL-Signature header untouched.
-- Goutham Pacha Ravi OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html
In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header. By sending a request with an empty URL-Signature header, an unauthenticated remote attacker who knows a target project's UUID may bypass both Keystone authentication and pre-signed URL verification, resulting in the ability to read, enumerate, create, and delete that project's queues, messages, claims, and subscriptions. By additionally claiming an administrative role, the attacker may also perform administrative operations, such as managing pools and flavors in adminmode deployments. Only deployments using the WSGI transport with an authentication strategy configured are affected; the websocket transport is not affected.
======================================================================= OSSA-2026-029: Zaqar EXTRA-SPEC header bypasses Keystone authentication =======================================================================
:Date: July 23, 2026 :CVE: CVE-2026-66139
Affects ~~~~~~~ - Zaqar: >=12.0.0 <20.1.1, ==21.0.0, ==22.0.0
Description ~~~~~~~~~~~ Errata ~~~~~~ Patches ~~~~~~~ - https://review.opendev.org/998411 (2025.1/epoxy) - https://review.opendev.org/998410 (2025.2/flamingo) - https://review.opendev.org/998400 (2026.1/gazpacho) - https://review.opendev.org/998272 (2026.2/hibiscus (development))
Credits ~~~~~~~ References ~~~~~~~~~~ - https://launchpad.net/bugs/2161254 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-66139
Notes ~~~~~ - https://review.opendev.org/998223 proposes removing the EXTRA-SPEC feature entirely as a follow-up hardening measure.
OSSA History ~~~~~~~~~~~~ - 2026-07-24 - Errata 1 - 2026-07-23 - Original Version
-- Goutham Pacha Ravi OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html
On 7/23/26 12:45 PM, Goutham Pacha Ravi wrote: ======================================================================= OSSA-2026-029: Zaqar EXTRA-SPEC header bypasses Keystone authentication =======================================================================
:Date: July 23, 2026 :CVE: CVE-2026-pending
Affects ~~~~~~~ - Zaqar: >=12.0.0 <20.1.1, ==21.0.0, ==22.0.0
Description ~~~~~~~~~~~ Chen YuXiang from the Institute of Computing Technology, Chinese Academy of Sciences reported that the Zaqar messaging service bypasses Keystone authentication when an EXTRA-SPEC header is present in the request. An unauthenticated attacker who knows a project UUID can read, enumerate, create, and delete that project's queues without a Keystone token. The EXTRA-SPEC header was intended to support an alternative authentication mechanism, but the backend validation was never implemented, resulting in a complete authentication bypass. All deployments running Zaqar 12.0.0 or later are affected.
Patches ~~~~~~~ - https://review.opendev.org/998272 (2026.2/hibiscus (development)) - https://review.opendev.org/998400 (2026.1/gazpacho) - https://review.opendev.org/998410 (2025.2/flamingo) - https://review.opendev.org/998411 (2025.1/epoxy)
Credits ~~~~~~~ References ~~~~~~~~~~ - https://launchpad.net/bugs/2161254 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-pending
Notes ~~~~~ - A CVE assignment is pending from MITRE. This advisory will be updated when the CVE is assigned. - https://review.opendev.org/998223 proposes removing the EXTRA-SPEC feature entirely as a follow-up hardening measure.
-- Goutham Pacha Ravi OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html
OpenStack Zaqar through 22.0.0 allows authentication bypass via an EXTRA-SPEC header when a UUID is known.
======================================================================= OSSA-2026-029: Zaqar EXTRA-SPEC header bypasses Keystone authentication =======================================================================
:Date: July 23, 2026 :CVE: CVE-2026-pending
Affects ~~~~~~~ - Zaqar: >=12.0.0 <20.1.1, ==21.0.0, ==22.0.0
Description ~~~~~~~~~~~ Chen YuXiang from the Institute of Computing Technology, Chinese Academy of Sciences reported that the Zaqar messaging service bypasses Keystone authentication when an EXTRA-SPEC header is present in the request. An unauthenticated attacker who knows a project UUID can read, enumerate, create, and delete that project's queues without a Keystone token. The EXTRA-SPEC header was intended to support an alternative authentication mechanism, but the backend validation was never implemented, resulting in a complete authentication bypass. All deployments running Zaqar 12.0.0 or later are affected.
Patches ~~~~~~~ - https://review.opendev.org/998272 (2026.2/hibiscus (development)) - https://review.opendev.org/998400 (2026.1/gazpacho) - https://review.opendev.org/998410 (2025.2/flamingo) - https://review.opendev.org/998411 (2025.1/epoxy)
Credits ~~~~~~~ References ~~~~~~~~~~ - https://launchpad.net/bugs/2161254 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-pending
Notes ~~~~~ - A CVE assignment is pending from MITRE. This advisory will be updated when the CVE is assigned. - https://review.opendev.org/998223 proposes removing the EXTRA-SPEC feature entirely as a follow-up hardening measure.
-- Goutham Pacha Ravi OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html