Log in Start free

Vulnerability · Published Sep 24, 2026 · Assigned by mitre

CVE-2026-97404

Critical 9.2

In plain English

A critical-severity security flaw in Zaqar from OpenStack. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)9.2Critical
Exploit odds (30 days)0.3%top 81.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header. By sending a request with an empty URL-Signature header, an unauthenticated remote attacker who knows a target project's UUID may bypass both Keystone authentication and pre-signed URL verification, resulting in the ability to read, enumerate, create, and delete that project's queues, messages, claims, and subscriptions. By additionally claiming an administrative role, the attacker may also perform administrative operations, such as managing pools and flavors in admin_mode deployments. Only deployments using the WSGI transport with an authentication strategy configured are affected; the websocket transport is not affected.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12zaqarno fix listedDEBIAN-CVE-2026-97404
Debian:13zaqarno fix listedDEBIAN-CVE-2026-97404
Debian:14zaqar23.0.0~rc1-3DEBIAN-CVE-2026-97404
Ubuntu:22.04:LTSzaqarno fix listedUBUNTU-CVE-2026-97404
Ubuntu:24.04:LTSzaqarno fix listedUBUNTU-CVE-2026-97404
Ubuntu:26.04:LTSzaqarno fix listedUBUNTU-CVE-2026-97404
Ubuntu:26.10zaqarno fix listedUBUNTU-CVE-2026-97404

Affected products (as reported)

VendorProductVersions
OpenStack Zaqar 1.0.0 – before 20.1.221.0.0 – before 21.0.222.0.0 – before 22.0.2

Weakness: CWE-348 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References