UNKNOWN OpenStack
CVE-2026-97404
OSSA-2026-042: Zaqar empty URL-Signature header bypasses authentication
pple, an independent security researcher, reported that Zaqar’s WSGI transport mishandles an empty URL-Signature header: a request carrying the header with an empty value bypasses both Keystone authentication and pre-signed URL verification. An unauthenticated remote attacker who knows a target project’s UUID can then read, enumerate, create, and delete that project’s queues, messages, claims, and subscriptions. By additionally claiming an administrative role, the attacker may also perform admin
Affected Products
- Zaqar: >=1.0.0 <20.1.2, >=21.0.0 <21.0.2, >=22.0.0 <22.0.2
- CVE-2026-97404
References
- https://security.openstack.org/ossa/OSSA-2026-042.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-97404
This unknown severity vulnerability was published on 2026-09-24 via OpenStack. Affected: Zaqar: >=1.0.0 <20.1.2, >=21.0.0 <21.0.2, >=22.0.0 <22.0.2, CVE-2026-97404.
vulnfeed aggregates 16937 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.