CVE-2026-97404

OpenStack Zaqar before 22.0.2 mishandles the URL-Signature header in its WSGI transport, so a request carrying an empty URL-Signature value bypasses both Keystone authentication and pre-signed URL verification. An unauthenticated remote attacker who knows a target project's UUID can exploit this to read, enumerate, create, and delete that project's queues, messages, claims, and subscriptions; by additionally claiming an administrative role, the attacker can also perform admin operations such as managing pools and flavors in admin_mode deployments. Only deployments using the WSGI transport with an authentication strategy configured are affected; the websocket transport is not. The flaw is rated critical (CVSS 4.0: 9.2), but successful exploitation requires prior knowledge of a victim project's UUID, which limits purely opportunistic attacks. No public PoC exists, there is no evidence of exploitation in the wild, and the CVE is not on CISA's KEV list.

What to do: Upgrade Zaqar to 22.0.2 or later as soon as possible. If patching is delayed, restrict network access to the Zaqar WSGI endpoint (typically port 8888) to trusted internal networks, verify that only intended auth strategies are configured, and review logs for requests with empty URL-Signature headers or unexpected queue, message, claim, and subscription activity. Treat project UUIDs as sensitive identifiers and rotate any that may have leaked, since knowing a project's UUID is a prerequisite for this attack.