Read the docs
TI-2026-69287 Aliases CVE-2026-107363GHSA-hc4w-8h6h-frmg

Project identifier not bound in OpenStack Zaqar WebSocket requests

Priority MEDIUM 60CWE-472Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
Low · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

OpenStack Zaqar from 1.0.0 before 20.1.3, from 21.0.0 before 21.0.3, from 22.0.0 before 22.0.3, and from 23.0.0 before 23.0.1 is affected. The WebSocket transport does not bind the project identifier in later requests to the project authenticated by the Keystone token, which is a case of external control of an assumed-immutable web parameter (CWE-472). An authenticated user with a valid token for one project can substitute another project's UUID to enumerate, inspect, create, or delete that project's queues, leading to unauthorized disclosure, modification, or loss of queue data. Only deployments using the WebSocket transport with Keystone authentication are affected.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. An authenticated user with a valid token for one project may substitute another project's UUID to enumerate, inspect, create, or delete queues belonging to that project, resulting in unauthorized disclosure, modification, or loss of queue data. Only deployments using the WebSocket transport with Keystone authentication are affected.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00455 39th percentileScored 2026-11-07
Fix Fixed Zaqar (OpenStack): 20.1.3, 21.0.3, 22.0.3 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenStackZaqar1.0.0 to before 20.1.3; 21.0.0 to before 21.0.3; 22.0.0 to before 22.0.3; 23.0.0 to before 23.0.120.1.3, 21.0.3, 22.0.3, 23.0.1Patch availableCNA
  • Zaqar VendorOpenStack Affected 1.0.0 to before 20.1.3; 21.0.0 to before 21.0.3; 22.0.0 to before 22.0.3; 23.0.0 to before 23.0.1 Fixed in 20.1.3, 21.0.3, 22.0.3, 23.0.1 Patch available CNA

Remediation

Upgrade OpenStack Zaqar to 20.1.3, 21.0.3, 22.0.3, or 23.0.1, depending on the release branch in use.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA Zaqar (OpenStack) Fixed in 20.1.3, 21.0.3, 22.0.3, 23.0.1

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-07 Threatist record created from CVE-2026-107363
  2. 2026-10-07 CISA SSVC decision points changed
  3. 2026-10-07 Alias added: GHSA-hc4w-8h6h-frmg
  4. 2026-11-06 Affected versions changed · Red Hat
  5. 2026-11-06 CVSS score added · Red Hat

References

Other 2

  • TI-2026-78562 Incorrect authorization in OpenStack Manila share operations CVSS 3.1CRITICAL 9.9
  • TI-2026-63467 Code injection in OpenStack Octavia CVSS 4.0CRITICAL 9.4
  • TI-2017-13226 The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before… CVSS 3.1CRITICAL 9.8
  • TI-2026-69629 OpenStack Mistral flaw lets users change other projects' resources CVSS 4.0HIGH 7.2
  • TI-2026-69623 Command injection in OpenStack Mistral std.ssh_proxied action CVSS 4.0HIGH 8.7
  • TI-2022-17779 Improper privilege management in OpenStack CVSS 3.1HIGH 8.8
See all 332 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences