[OSSA-2026-042] OpenStack Zaqar: Zaqar empty URL-Signature header bypasses authentication (CVE-2026-97404)

OpenStack Zaqar before 22.0.2 mishandles the URL-Signature header in its WSGI transport, so a request carrying an empty URL-Signature value bypasses both Keystone authentication and pre-signed URL verification. An unauthenticated remote attacker who knows a target project's UUID can exploit this to read, enumerate, create, and delete that project's queues, messages, claims, and subscriptions; by additionally claiming an administrative role, the attacker can also perform admin operations such as managing pools and flavors in admin_mode deployments. Only deployments using the WSGI transport with an authentication strategy configured are affected; the websocket transport is not. The flaw is rated critical (CVSS 4.0: 9.2), but successful exploitation requires prior knowledge of a victim project's UUID, which limits purely opportunistic attacks. No public PoC exists, there is no evidence of exploitation in the wild, and the CVE is not on CISA's KEV list.