CVE-2026-97404 OpenStack CVE debrief

Who should care

OpenStack Zaqar administrators and users with projects configured to use the WSGI transport with an authentication strategy are affected by this vulnerability. They should review and update OpenStack Zaqar to version 22.0.2 or later and verify authentication strategy configurations for WSGI transport. Additionally, they should monitor project queues, messages, claims, and subscriptions for suspicious activity.

Why it matters

CVE-2026-97404 is a critical vulnerability in OpenStack Zaqar that allows unauthenticated remote attackers to bypass Keystone authentication and pre-signed URL verification, potentially leading to unauthorized access and manipulation of project resources.

• Potential unauthorized access to project queues, messages, claims, and subscriptions
• Possible enumeration of project resources
• Potential creation and deletion of project resources
• Administrative operations may be performed in admin_mode deployments

Technical summary

The WSGI transport in OpenStack Zaqar mishandles the URL-Signature header, allowing unauthenticated remote attackers to bypass Keystone authentication and pre-signed URL verification. This vulnerability affects deployments using the WSGI transport with an authentication strategy configured. The websocket transport is not affected. By sending a request with an empty URL-Signature header, an attacker may bypass authentication and perform unauthorized actions, such as reading, enumerating, creating, and deleting project resources.

Defensive priority

High

Recommended defensive actions

• Review and update OpenStack Zaqar to version 22.0.2 or later
• Verify authentication strategy configurations for WSGI transport
• Monitor project queues, messages, claims, and subscriptions for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability. Additional details are limited, but defenders should verify the affected scope, severity, and vendor guidance. The WSGI transport mishandles the URL-Signature header, allowing unauthenticated remote attackers to bypass Keystone authentication and pre-signed URL verification.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.