OpenStack Zaqar EUVD-2026-85915

Exploitation requires that the deployment uses the Zaqar WSGI transport WITH an authentication strategy configured - the websocket transport is explicitly NOT affected. The attacker must also know the target project's UUID (this is the AT:P / attack-requirement condition). Given those, exploitation is remote and unauthenticated (PR:N): the attacker simply sends a request bearing an empty URL-Signature header to bypass both Keystone auth and pre-signed URL verification. Escalation to administrative operations (managing pools and flavors) additionally requires the deployment to run in admin_mode, where the attacker asserts an administrative role.

This is a genuine high-priority authentication bypass, not merely a high-CVSS-but-low-risk paper finding. The vendor/MITRE CVSS 4.0 vector (9.2, AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H) correctly captures that an unauthenticated network attacker fully compromises confidentiality, integrity and availability of a project's messaging data by defeating Keystone authentication itself (CWE-348). The one moderating signal is AT:P (attack requirements present): the attacker must know the target project's UUID, which is a per-tenant secret-ish identifier - in my own CVSS 3.1 assessment I map this to AC:H, yielding ~8.1 rather than the near-maximum 9.2, because UUID discovery is a real, non-trivial precondition. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active or automated exploitation at time of analysis; the risk is driven by the severity and simplicity of the flaw (send one request with an empty header), not by observed weaponization. Conflicting/uncertain signal to verify: exploitation is strictly conditional on deployment mode - only WSGI transport with an auth strategy configured is affected - so the raw score overstates risk for websocket-transport deployments, which are unaffected.

An attacker who has learned a tenant's OpenStack project UUID (e.g., from logs, API leakage, or a prior low-privilege foothold) sends an HTTP request to the Zaqar WSGI endpoint with an empty URL-Signature header, which bypasses both Keystone authentication and pre-signed URL verification. They then read, enumerate, create, and delete that project's queues, messages, claims, and subscriptions, and by asserting an administrative role can manage pools and flavors in admin_mode deployments. No public exploit code was identified in the provided data, but the technique is trivial to reproduce given the single-header trigger.