CVE-2026-107363
In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. An authenticated user with a v
OpenStack ZaqarContainers & cloud
CVSS
6.1MediumExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 7 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.46%Chance of exploitation activity in the next 30 days, higher than 38% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. An authenticated user with a valid token for one project may substitute another project's UUID to enumerate, inspect, create, or delete queues belonging to that project, resulting in unauthorized disclosure, modification, or loss of queue data. Only deployments using the WebSocket transport with Keystone authentication are affected.
Text from CVE List
Affected versions 4
- Zaqaraffected: 1.0.0 before 20.1.3CVE List
- Zaqaraffected: 21.0.0 before 21.0.3CVE List
- Zaqaraffected: 22.0.0 before 22.0.3CVE List
- Zaqaraffected: 23.0.0 before 23.0.1CVE List