Re: [OSSA-2026-043] OpenStack Zaqar: Zaqar WebSocket project substitution allows cross-project queue access (CVE-2026-107363) errata 1

OpenStack Zaqar before 23.0.1 fails, on its WebSocket transport, to bind later requests to the project authenticated by the Keystone token. An authenticated user who already holds a valid token for one project can substitute another project's UUID and then enumerate, inspect, create, or delete that project's queues, which can disclose, modify, or destroy queue data. Only deployments that use the WebSocket transport together with Keystone authentication are affected. No public proof-of-concept is known, the issue is not in CISA KEV, and the related notice is the OpenStack advisory OSSA-2026-043.

Do: Upgrade OpenStack Zaqar to 23.0.1 or later. Until that is done, disable the WebSocket transport (or stop using it with Keystone) and review access logs for requests whose project UUID does not match the project bound to the Keystone token. Confirm the deployment actually uses WebSocket with Keystone before treating this as in scope; other transports are not described as affected.