Summary
CVE-2026-97404 is a critical authentication bypass vulnerability in OpenStack Zaqar, the OpenStack messaging and notification service. The flaw resides in Zaqar’s WSGI transport, where a blank/empty URL-Signature header is mishandled by both the Keystone authentication check and the pre-signed URL verification logic, allowing an unauthenticated remote attacker to bypass authentication entirely. An attacker who knows a target project’s UUID can gain unauthorized access to queues, messages, claims, and subscriptions, and in certain deployment configurations can also perform administrative operations — earning this issue a CVSS score of 9.2 (Critical).
Technical details
- Root cause: Zaqar’s WSGI transport uses a falsy check (e.g.,
if not signature:) rather than an explicitNonecheck when validating theURL-Signatureheader used for pre-signed URL verification. An empty-string header value passes this check, causing both the Keystone authentication path and the pre-signed URL signature verification path to be silently skipped. - Trigger conditions: The target deployment must use Zaqar’s WSGI transport (the default transport) with an authentication strategy such as Keystone configured. The attacker needs no valid credentials — only knowledge of the target project’s UUID.
- Attack vector: Network — the attacker sends a crafted HTTP request to the Zaqar API with an empty
URL-Signatureheader and the victim project’s UUID, requiring no user interaction and no prior authentication. - Impact: Successful exploitation allows an unauthenticated attacker to read, enumerate, create, and delete queues, messages, claims, and subscriptions belonging to the targeted project. In some deployment configurations, the bypass also permits administrative operations, resulting in a complete loss of confidentiality, integrity, and availability for the affected messaging data.
- Note: The WebSocket transport is not affected by this issue; only the WSGI transport is vulnerable.
Affected software
- OpenStack Zaqar versions 1.0.0 up to (but not including) 20.1.2
- OpenStack Zaqar versions 21.0.0 up to (but not including) 21.0.2
- OpenStack Zaqar versions 22.0.0 up to (but not including) 22.0.2
Severity
- CVSS v4.0 Base Score: 9.2 (Critical)
- Vector:
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CWE-348: Use of Less Trusted Source
Mitigation and recommended actions
- Immediate: Upgrade OpenStack Zaqar to version 20.1.2, 21.0.2, or 22.0.2 (or later), which correct the signature validation logic to explicitly reject empty or missing
URL-Signatureheader values. - If immediate patching is not possible:
- Restrict network access to the Zaqar WSGI API endpoint to trusted internal networks or VPNs only, reducing exposure to unauthenticated remote attackers.
- Monitor and audit Zaqar API access logs for requests containing an empty or malformed
URL-Signatureheader, and for anomalous queue/message/subscription activity tied to unexpected project UUIDs. - Where feasible, disable or avoid reliance on pre-signed URL authentication until patched, favoring properly enforced Keystone token authentication for all Zaqar API access.
- Treat project UUIDs as sensitive values and avoid unnecessary exposure of them, since knowledge of a project UUID is a prerequisite for exploitation.