CVE-2026-97404: OpenStack Zaqar Auth Bypass Vulnerability

CVE-2026-97404 Overview

CVE-2026-97404 is an authentication bypass vulnerability in OpenStack Zaqar before version 22.0.2. The Web Server Gateway Interface (WSGI) transport mishandles the URL-Signature header. An unauthenticated remote attacker who knows a target project's Universally Unique Identifier (UUID) can send a request with an empty URL-Signature header to bypass Keystone authentication and pre-signed URL verification. Successful exploitation allows attackers to read, enumerate, create, and delete queues, messages, claims, and subscriptions in the targeted project. By claiming an administrative role, attackers can also manage pools and flavors in admin_mode deployments.

Critical Impact

Unauthenticated attackers can fully compromise message queue data and perform administrative operations in affected OpenStack Zaqar deployments using WSGI transport.

Affected Products

• OpenStack Zaqar versions before 22.0.2
• Deployments using WSGI transport with an authentication strategy configured
• Deployments running in admin_mode (for administrative operation abuse)

Discovery Timeline

• 2026-09-24 - CVE-2026-97404 published to the National Vulnerability Database
• 2026-09-26 - Last updated in NVD database

Technical Details for CVE-2026-97404

Vulnerability Analysis

The vulnerability resides in the WSGI transport layer of OpenStack Zaqar, the message and notifications service for OpenStack. Zaqar supports pre-signed URL verification as an authentication mechanism alongside Keystone identity integration. The header parsing logic treats an empty URL-Signature header as a valid signed request rather than rejecting it. This logic flaw allows attackers to bypass both the Keystone authentication path and the pre-signed URL verification path simultaneously. The weakness falls under CWE-348: Use of Less Trusted Source, reflecting improper trust in client-controlled header input.

Root Cause

The URL-Signature header handling fails to differentiate between a legitimate signed request and a request bearing an empty signature value. When the header is present but empty, the authentication strategy returns a successful outcome without validating any cryptographic material or Keystone token. The project UUID supplied in the request path is then trusted as the authorization context for subsequent queue, message, claim, and subscription operations.

Attack Vector

An attacker must know the UUID of a target project to exploit the vulnerability. Project UUIDs are often exposed through logs, API responses, support tickets, or configuration files, and may be enumerable in some deployments. The attacker sends an HTTP request to the Zaqar WSGI endpoint with the URL-Signature header set to an empty value. The request succeeds without any token or valid signature. The vulnerability is remotely exploitable over the network with low attack complexity and does not require user interaction. The websocket transport is not affected.

No verified exploit code examples are available. See the Launchpad Bug Report #2164987 and the Openwall OSS-Security List Discussion for additional technical details.

Detection Methods for CVE-2026-97404

Indicators of Compromise

• HTTP requests to Zaqar WSGI endpoints containing a URL-Signature header with an empty value
• Unexpected queue, subscription, or flavor creation and deletion events in Zaqar audit logs
• Access to project queues from source IP addresses outside normal management ranges
• Administrative operations against pools or flavors originating from non-admin service accounts

Detection Strategies

• Inspect reverse proxy and load balancer logs for requests carrying an empty URL-Signature header to Zaqar endpoints
• Correlate Zaqar API activity with Keystone authentication logs; successful queue operations without a corresponding Keystone token issuance indicate bypass
• Alert on administrative Zaqar operations such as pool or flavor management performed by unexpected principals

Monitoring Recommendations

• Enable verbose request logging on the Zaqar WSGI service and ship logs to a centralized analytics platform
• Baseline normal queue, message, and subscription operation volumes per project and alert on deviations
• Monitor project UUID exposure across public documentation, repositories, and support channels

How to Mitigate CVE-2026-97404

Immediate Actions Required

• Upgrade OpenStack Zaqar to version 22.0.2 or later as the primary remediation
• Audit Zaqar access logs for requests with an empty URL-Signature header dating back to the deployment date of any affected version
• Rotate any secrets, credentials, or sensitive data that may have been transmitted through Zaqar queues
• Restrict network access to the Zaqar WSGI endpoint to trusted management networks until patching is complete

Patch Information

The upstream fix is included in OpenStack Zaqar 22.0.2 and later releases. Operators should apply the vendor-supplied package update through their distribution's channels and restart the Zaqar WSGI service. Reference the Launchpad Bug Report #2164987 for patch commit details.

Workarounds

• Switch to the websocket transport if feasible, as it is not affected by this vulnerability
• Place a reverse proxy in front of Zaqar that strips or rejects requests containing an empty URL-Signature header
• Disable admin_mode where not strictly required to limit the scope of administrative abuse
• Treat project UUIDs as sensitive values and avoid exposing them in logs, support channels, or public artifacts

# Example NGINX rule to reject requests with an empty URL-Signature header
if ($http_url_signature = "") {
    return 400;
}