← Back to the live CVE advisory feed

CVE-2026-97404: Product identification pending

Severity

9.2 (CRITICAL)

Vendor

OPENSTACK ZAQAR

Affected versions

Before 22.0.2

Fixed version

22.0.2

Patch status

Patched

Published

2026-09-24T15:18:01.537

Modified

2026-09-24T15:18:01.537

Why it matters

This matters because the affected product may be exploitable without valid credentials. Internet-facing deployments should be reviewed first.

Recommended admin actions

• Prioritize validation immediately due to critical CVSS severity.
• Compare installed versions against the affected version range in the advisory.
• Treat internet-facing systems as higher priority.

Technical summary

In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header. By sending a request with an empty URL-Signature header, an unauthenticated remote attacker who knows a target project's UUID may bypass both Keystone authentication and pre-signed URL verification, resulting in the ability to read, enumerate, create, and delete that project's queues, messages, claims, and subscriptions. By additionally claiming an administrative role, the attacker may also perform administrative operations, such as managing pools and flavors in admin_mode deployments. Only deployments using the WSGI transport with an authentication strategy configured are affected; the websocket transport is not affected.

View the official NVD record for CVE-2026-97404

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.