Aller au contenu
en Se connecter
6.1 Moyenne

CVE-2026-107363 In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to…

Description

In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. An authenticated user with a valid token for one project may substitute another project's UUID to enumerate, inspect, create, or delete queues belonging to that project, resulting in unauthorized disclosure, modification, or loss of queue data. Only deployments using the WebSocket transport with Keystone authentication are affected.

Produits et versions touchés

Produit Versions touchées Corrigé en
Zaqar 23.0 23.0.0 → < 23.0.1 23.0.1
Zaqar 22.0 22.0.0 → < 22.0.3 22.0.3
Zaqar 21.0 21.0.0 → < 21.0.3 21.0.3
Zaqar 1.0 1.0.0 → < 20.1.3 20.1.3

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Zaqar

Les 3 CVE de Zaqar →
CVE-2026-97404 In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header 9.2 Critique CVE-2026-66139 OpenStack Zaqar through 22.0.0 allows authentication bypass via an EXTRA-SPEC header when a UUID is known 4.8 Moyenne
Suivre cette CVE