Is CVE-2026-66139 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-66139 being exploited in the wild.

How severe is CVE-2026-66139?

Medium severity, with a CVSS score of 4.8, published 24 July 2026.

Which products and versions are affected?

OpenStack Zaqar >=12.0.0 <20.1.1, 21.0.0, 22.0.0.

Is there a fix for CVE-2026-66139?

A patch was published on 2026-07-24: CVE published and patches released for multiple branches Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-66139 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-66139?

Check whether you run OpenStack Zaqar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-66139: OpenStack Zaqar authentication bypass via EXTRA-SPEC header

Q: Is there a fix for CVE-2026-66139?

A patch was published on 2026-07-24: CVE published and patches released for multiple branches Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-66139 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-66139?

Check whether you run OpenStack Zaqar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-66139 · Severity: medium · CVSS 4.8 · Published 2026-07-24

OpenStack Zaqar, a messaging service for cloud applications, contains a flaw that allows unauthorized users to bypass security checks. By including a specific header in their requests, an attacker who knows a project's unique ID can read, create, or delete message queues without a valid login. This could lead to unauthorized access to sensitive communication data or disruption of cloud service operations.

Vendors: OpenStack.

Quick answers

Is CVE-2026-66139 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-66139 being exploited in the wild.
How severe is CVE-2026-66139?: Medium severity, with a CVSS score of 4.8, published 24 July 2026.
Which products and versions are affected?: OpenStack Zaqar >=12.0.0 <20.1.1, 21.0.0, 22.0.0.
Is there a fix for CVE-2026-66139?: A patch was published on 2026-07-24: CVE published and patches released for multiple branches Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-66139 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-66139?: Check whether you run OpenStack Zaqar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authentication bypass vulnerability exists in OpenStack Zaqar's v2 API due to improper handling of the 'EXTRA-SPEC' HTTP header. The Zaqar authentication middleware (auth.py) is designed to skip standard Keystone token validation if it detects an EXTRA-SPEC header, intended for alternative authentication tasks. However, the backend 'messagecode' task handler was implemented as a no-op, performing no actual validation. An unauthenticated remote attacker who knows or guesses a target project's UUID can use this header to perform CRUD operations on that project's queues. The vulnerability affects versions 12.0.0 through 22.0.0 and has been addressed in various stable branch patches.

Affected products

OpenStack Zaqar >=12.0.0 <20.1.1, 21.0.0, 22.0.0

Timeline

2026-07-19: disclosed: Bug reported to OpenStack Launchpad
2026-07-23: advisory: OpenStack Security Advisory OSSA-2026-029 published
2026-07-24: patched: CVE published and patches released for multiple branches

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.