Authentication Bypass in OpenStack Zaqar via EXTRA-SPEC Header

Executive Summary

CVE-2026-66139 is an authentication bypass vulnerability in OpenStack Zaqar versions 12.0.0 and later. It allows unauthenticated attackers with knowledge of a project UUID to bypass Keystone authentication by using an EXTRA-SPEC header in Zaqar requests. This enables unauthorized actions like reading, enumerating, creating, and deleting queues within the target project.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for Zaqar API requests containing the EXTRA-SPEC header. Check Zaqar logs for unauthorized queue operations (create, read, delete) without valid Keystone tokens. Inspect HTTP headers in requests to Zaqar endpoints for the presence of EXTRA-SPEC.

Useful 0 Not Useful 0

Impact Analysis

If you use OpenStack Zaqar, an attacker could exploit this to access or manipulate queues in your project without credentials. This could lead to data leakage, unauthorized queue operations, or disruption of messaging services. The impact depends on the sensitivity of data stored in queues.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements like GDPR or HIPAA by enabling unauthorized access to sensitive data stored in queues. Unauthorized data exposure or manipulation may result in regulatory penalties or loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

Apply available patches for your OpenStack Zaqar version immediately. Remove or disable the EXTRA-SPEC header functionality in Zaqar configuration. Restrict network access to Zaqar API endpoints to trusted sources only. Monitor for unauthorized queue operations and review logs for suspicious activity.

Useful 0 Not Useful 0