CVE-2026-66139: OpenStack Zaqar Auth Bypass Vulnerability

CVE-2026-66139 Overview

CVE-2026-66139 is an authentication bypass vulnerability affecting OpenStack Zaqar through version 22.0.0. The flaw allows an unauthenticated attacker to bypass authentication by supplying an EXTRA-SPEC header when a valid queue or resource UUID is known. Zaqar is the OpenStack messaging service that provides multi-tenant queues and notifications for cloud workloads. The Common Weakness Enumeration classifies this issue as [CWE-306]: Missing Authentication for Critical Function. Successful exploitation grants limited access to messaging resources without valid credentials.

Critical Impact
An attacker with knowledge of a resource UUID can bypass authentication controls in OpenStack Zaqar and interact with messaging queues, breaking tenant isolation in multi-tenant OpenStack deployments.

Affected Products

OpenStack Zaqar versions up to and including 22.0.0
OpenStack deployments exposing the Zaqar messaging API
Multi-tenant cloud environments relying on Zaqar for queue-based notifications

Discovery Timeline

2026-07-24 - CVE-2026-66139 published to the National Vulnerability Database
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-66139

Vulnerability Analysis

OpenStack Zaqar exposes REST endpoints for queue management, message posting, and subscription handling. The service normally requires Keystone-backed authentication to associate requests with a tenant. This vulnerability originates from improper handling of the EXTRA-SPEC HTTP header during request processing. When the header is present and the caller supplies a valid resource UUID, Zaqar accepts the request without completing the standard authentication path.

The attack vector is network-based and requires no user interaction. Attack complexity is high because the attacker must first obtain a valid UUID for a target Zaqar resource. UUIDs may leak through logs, error messages, misconfigured integrations, or predictable naming in automation. Impact is limited to loss of confidentiality and availability of messaging resources, with no direct integrity impact recorded.

Root Cause

The root cause is missing authentication enforcement on a code path gated by the EXTRA-SPEC header. The Zaqar middleware treats requests carrying this header as pre-authorized when a UUID identifier is present, skipping token validation against Keystone. This design assumption breaks the trust model between the API gateway, the Keystone identity service, and the Zaqar backend.

Attack Vector

An attacker sends an HTTP request to a reachable Zaqar API endpoint with the EXTRA-SPEC header set and a known resource UUID in the request path or body. Because Zaqar bypasses authentication for this request pattern, the attacker can enumerate or manipulate the associated queue without a valid Keystone token. In multi-tenant clouds, this breaks tenant isolation once any UUID leaks. Technical detail is available in the Launchpad Bug Report and the Openwall OSS Security Discussion.

Detection Methods for CVE-2026-66139

Indicators of Compromise

HTTP requests to Zaqar API endpoints containing the EXTRA-SPEC header, particularly from clients that do not present a valid X-Auth-Token
Access to queue UUIDs from source IPs outside the expected control-plane ranges
Anomalous message posting, deletion, or subscription activity on queues without corresponding Keystone token issuance events

Detection Strategies

Inspect Zaqar wsgi access logs for the string EXTRA-SPEC in request headers and correlate with authentication outcomes
Cross-reference Zaqar API activity with Keystone token validation events to identify requests processed without a preceding authentication
Alert on requests that access resource UUIDs belonging to tenants other than the authenticated caller

Monitoring Recommendations

Forward Zaqar and Keystone logs into a centralized SIEM with normalization for HTTP header fields
Build detection rules that flag any 2xx response to a Zaqar endpoint when the request contained the EXTRA-SPEC header
Monitor east-west traffic to the Zaqar service for unexpected client identities inside the OpenStack management network

How to Mitigate CVE-2026-66139

Immediate Actions Required

Upgrade OpenStack Zaqar to a fixed release published after version 22.0.0 once available from the OpenStack Security Advisory team
Restrict network access to the Zaqar API so that only trusted service accounts and API gateways can reach it
Audit historical Zaqar logs for prior requests containing the EXTRA-SPEC header and investigate any matches

Patch Information

Refer to the OpenStack Security Advisory tracker for the authoritative fix. Details on remediation status are maintained in the Launchpad Bug Report and the Openwall OSS Security Thread. Operators running downstream distributions such as Red Hat OpenStack Platform, Canonical Charmed OpenStack, or Kolla-based deployments should apply vendor-supplied backports once released.

Workarounds

Configure the fronting reverse proxy or API gateway to strip the EXTRA-SPEC header from all inbound requests to Zaqar
Enforce mandatory Keystone token validation at the load balancer for every Zaqar API path, denying requests that lack a valid X-Auth-Token
Rotate any resource UUIDs that may have been exposed in logs, tickets, or third-party integrations

bash

# Example nginx configuration to strip the EXTRA-SPEC header before proxying to Zaqar
location /zaqar/ {
    proxy_set_header EXTRA-SPEC "";
    proxy_pass http://zaqar_backend;
}