In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header.
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 2 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.
Summary
In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header. By sending a request with an empty URL-Signature header, an unauthenticated remote attacker who knows a target project's UUID may bypass both Keystone authentication and pre-signed URL verification, resulting in the ability to read, enumerate, create, and delete that project's queues, messages, claims, and subscriptions. By additionally claiming an administrative role, the attacker may also perform administrative operations, such as managing pools and flavors in admin_mode deployments. Only deployments using the WSGI transport with an authentication strategy configured are affected; the websocket transport is not affected.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| OpenStack | Zaqar | 1.0.0 to before 20.1.2; 21.0.0 to before 21.0.2; 22.0.0 to before 22.0.2 | 20.1.2, 21.0.2, 22.0.2 | Patch available | CNA |
- Zaqar VendorOpenStack Affected 1.0.0 to before 20.1.2; 21.0.0 to before 21.0.2; 22.0.0 to before 22.0.2 Fixed in 20.1.2, 21.0.2, 22.0.2 Patch available CNA
Remediation
- Fix · CNA Zaqar (OpenStack) Fixed in 20.1.2, 21.0.2, 22.0.2
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix yet |
| Red Hat OpenStack Platform 16.2 | Affected | No fix yet |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-97404
- 2026-10-03 Alias added: GHSA-j2hp-rfqr-h9c7
- 2026-10-08 Affected versions changed · Red Hat
- 2026-10-08 CVSS score added · Red Hat
References
More OpenStack vulnerabilities
- TI-2026-78562 Incorrect authorization in OpenStack Manila share operations CVSS 3.1CRITICAL 9.9
- TI-2026-63467 Code injection in OpenStack Octavia CVSS 4.0CRITICAL 9.4
- TI-2017-13226 The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before… CVSS 3.1CRITICAL 9.8
- TI-2026-69629 OpenStack Mistral flaw lets users change other projects' resources CVSS 4.0HIGH 7.2
- TI-2026-69623 Command injection in OpenStack Mistral std.ssh_proxied action CVSS 4.0HIGH 8.7
- TI-2022-17779 Improper privilege management in OpenStack CVSS 3.1HIGH 8.8
Sources
- CVE-2026-97404 · CVE Program
- CVE-2026-97404 · NVD
- FIRST EPSS
- GHSA-j2hp-rfqr-h9c7 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-97404 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences