WSGI Transport URL-Signature Bypass in OpenStack Zaqar

Executive Summary

CVE-2026-97404 is a vulnerability in OpenStack Zaqar's WSGI transport where an empty URL-Signature header bypasses Keystone authentication and pre-signed URL verification. An unauthenticated remote attacker with a target project's UUID can send a request with an empty URL-Signature header to bypass security checks and gain unauthorized access to queues, messages, claims, and subscriptions.

Useful 0 Not Useful 0

Detection Guidance

Monitor for unusual API requests to OpenStack Zaqar endpoints with empty URL-Signature headers. Check logs for requests containing X-Project-ID or X-Roles headers without valid authentication tokens. Use tools like tcpdump or Wireshark to inspect HTTP headers for suspicious patterns targeting Zaqar's WSGI transport.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to read, enumerate, create, and delete queues, messages, claims, and subscriptions in your project. If the attacker claims an administrative role, they can also perform administrative operations like managing pools and flavors in admin_mode deployments. The attack requires no authentication token and exploits flawed empty-value checks in authentication middleware.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenStack Zaqar to version 22.0.2 or later. Apply patches that enforce non-empty URL-Signature header validation. Disable the WSGI transport if not required. Review and restrict administrative roles to prevent unauthorized privilege escalation. Monitor for exploitation attempts in logs.

Useful 0 Not Useful 0