Skip to content
OpenAdvisories
Medium · 6.1 CVE-2026-107363 EUVD-2026-94614GHSA-hc4w-8h6h-frmg

In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authen…

Published Oct 7, 2026 · Updated Oct 7, 2026 · Assigned by mitre

Description

In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. An authenticated user with a valid token for one project may substitute another project's UUID to enumerate, inspect, create, or delete queues belonging to that project, resulting in unauthorized disclosure, modification, or loss of queue data. Only deployments using the WebSocket transport with Keystone authentication are affected.

Affected products

VendorProductAffectedFixed
OpenStack Zaqar 1.0.0 – < 20.1.3, 21.0.0 – < 21.0.3, 22.0.0 – < 22.0.3, 23.0.0 – < 23.0.1 20.1.3

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 zaqar 23.0.0-2 —
Debian 13 zaqar No fix yet —
Debian 12 zaqar No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 zaqar No fix yet —
Ubuntu 26.04 LTS zaqar No fix yet —
Ubuntu 24.04 LTS zaqar No fix yet —
Ubuntu 22.04 LTS zaqar No fix yet —
Ubuntu 20.04 LTS zaqar No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS zaqar No fix yet —
Ubuntu 16.04 LTS zaqar No fix yet —

References