What’s Vulnerable › Vulnerabilities

CVE-2026-107363

• Severity: medium (CVSS 6.1 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-07 · updated 2026-10-08
• Weakness: CWE-472

Description

In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. An authenticated user with a valid token for one project may substitute another project's UUID to enumerate, inspect, create, or delete queues belonging to that project, resulting in unauthorized disclosure, modification, or loss of queue data. Only deployments using the WebSocket transport with Keystone authentication are affected.

Affected products

• OpenStack Zaqar: from 1.0.0 before 20.1.3; from 21.0.0 before 21.0.3; from 22.0.0 before 22.0.3; from 23.0.0 before 23.0.1 — fixed in 20.1.3, 21.0.3, 22.0.3, 23.0.1

How to fix

Upgrade to a fixed version: OpenStack Zaqar 20.1.3, 21.0.3, 22.0.3, 23.0.1. Check the vendor advisory for mitigations.

References

• https://launchpad.net/bugs/2161402
• https://www.openwall.com/lists/oss-security/2026/10/07/30
• http://www.openwall.com/lists/oss-security/2026/10/07/31
• https://launchpad.net/bugs/2161402

Get alerted when CVE-2026-107363 or the next vulnerability affects your stack