CVE-2026-66139 OpenStack Zaqar through 22.0.0 allows authentication bypass via an EXTRA-SPEC header when a UUID is known

Description

OpenStack Zaqar through 22.0.0 allows authentication bypass via an EXTRA-SPEC header when a UUID is known.

Affected products and versions

Product	Affected versions	Fixed in
Zaqar	22.0.0	No fix stated
Zaqar	21.0.0	No fix stated
Zaqar 12.0	12.0.0 → < 20.1.1	20.1.1

Other CVEs of Zaqar

The 3 CVEs of Zaqar →

CVE-2026-107363 In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to… 6.1 Medium CVE-2026-97404 In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header 9.2 Critical