[OSSA-2026-042] OpenStack Zaqar: Zaqar empty URL-Signature header bypasses authentication (CVE-2026-97404)
OpenStack Zaqar advisory CVE-2026-97404: an empty URL-Signature header can bypass authentication.
OpenStack Security Advisory OSSA-2026-042 discloses CVE-2026-97404 in the Zaqar messaging service. An empty URL-Signature header can bypass authentication. An independent security researcher reported the flaw, and the notice lists affected Zaqar releases with 22.0.2 as a fix boundary. The advisory does not say the bug is being exploited.
- Empty URL-Signature header bypasses Zaqar authentication
- Tracked as CVE-2026-97404 and OSSA-2026-042
- Independent researcher reported the authentication flaw
- Advisory does not report active exploitation
- CVEs
- CVE-2026-97404
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-97404 | Auth Bypass via Empty URL-Signature Header in OpenStack Zaqar WSGI Transport | 9.2 | — |
From the original article
Posted by Goutham Pacha Ravi on Sep 24 ======================================================================= OSSA-2026-042: Zaqar empty URL-Signature header bypasses authentication ======================================================================= :Date: September 24, 2026 :CVE: CVE-2026-97404 Affects ~~~~~~~ - Zaqar: >=1. 0. 0 =21.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.