CVE-2026-107363 OpenStack CVE debrief

Who should care

Defenders responsible for OpenStack Zaqar deployments using the WebSocket transport with Keystone authentication should assess exposure and prioritize verification and remediation efforts.

Why it matters

CVE-2026-107363 is a medium-severity vulnerability in OpenStack Zaqar that allows authenticated users to substitute another project's UUID and access queue data without authorization. Defenders responsible for OpenStack Zaqar deployments using the WebSocket transport with Keystone authentication should assess exposure and prioritize verification and remediation efforts.

• Potential unauthorized disclosure of queue data
• Potential unauthorized modification of queue data
• Potential loss of queue data due to unauthorized deletion
• Verification of Keystone token authentication and authorization settings

Technical summary

The vulnerability exists in OpenStack Zaqar before version 23.0.1, where the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. This allows an authenticated user with a valid token for one project to substitute another project's UUID to enumerate, inspect, create, or delete queues belonging to that project, potentially leading to unauthorized disclosure, modification, or loss of queue data. The issue is specific to deployments using the WebSocket transport with Keystone authentication.

Defensive priority

Defenders should prioritize verifying and upgrading to a fixed version of OpenStack Zaqar, as well as monitoring and restricting WebSocket transport usage.

Recommended defensive actions

• Verify and upgrade to a fixed version of OpenStack Zaqar
• Monitor and restrict WebSocket transport usage
• Review and update Keystone token authentication and authorization settings
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to issue tracking and security mailing lists. The WebSocket transport in OpenStack Zaqar fails to bind the project identifier in subsequent requests, allowing an authenticated user with a valid token for one project to substitute another project's UUID. This could lead to unauthorized disclosure, modification, or loss of queue data. Defenders should verify the Keystone token authentication and authorization

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.