CVE-2026-107363

Received Received - Intake

WebSocket Transport Project ID Bypass in OpenStack Zaqar

Publication date: 2026-10-07

Last updated on: 2026-10-07

Assigner: MITRE

Description

In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. An authenticated user with a valid token for one project may substitute another project's UUID to enumerate, inspect, create, or delete queues belonging to that project, resulting in unauthorized disclosure, modification, or loss of queue data. Only deployments using the WebSocket transport with Keystone authentication are affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-07

Last Modified

2026-10-07

Generated

2026-10-08

AI Q&A

2026-10-08

EPSS Evaluated

N/A

NVD

CVE-2026-107363

Affected Vendors & Products

Vendor	Product	Version / Range
OpenStack	Zaqar	1.0.0
OpenStack	Zaqar	21.0.0
OpenStack	Zaqar	22.0.0
OpenStack	Zaqar	23.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-472	The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields.

Attack-Flow Graph

Executive Summary

This vulnerability in OpenStack Zaqar before 23.0.1 allows an authenticated user to manipulate WebSocket requests by substituting another project's UUID. This bypasses project isolation, enabling unauthorized access to queues belonging to different projects.

Impact Analysis

An attacker could read, modify, or delete queue data from other projects, leading to data breaches, data loss, or service disruption. Only systems using WebSocket transport with Keystone authentication are affected.

Compliance Impact

This vulnerability could violate data protection requirements by enabling unauthorized access to sensitive data, potentially leading to non-compliance with GDPR, HIPAA, or other regulations that mandate strict data isolation and access controls.

Mitigation Strategies

Upgrade OpenStack Zaqar to version 23.0.1 or later to address the WebSocket transport issue with project identifier binding.

Hi! I’m here to help you understand CVE-2026-107363. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70