Executive brief
OpenStack Zaqar, a messaging service for cloud applications, contains a flaw that allows unauthorized users to bypass security checks. By including a specific header in their requests, an attacker who knows a project's unique ID can read, create, or delete message queues without a valid login. This could lead to unauthorized access to sensitive communication data or disruption of cloud service operations.
Technical details
An authentication bypass vulnerability exists in OpenStack Zaqar's v2 API due to improper handling of the 'EXTRA-SPEC' HTTP header. The Zaqar authentication middleware (auth.py) is designed to skip standard Keystone token validation if it detects an EXTRA-SPEC header, intended for alternative authentication tasks. However, the backend 'messagecode' task handler was implemented as a no-op, performing no actual validation. An unauthenticated remote attacker who knows or guesses a target project's UUID can use this header to perform CRUD operations on that project's queues. The vulnerability affects versions 12.0.0 through 22.0.0 and has been addressed in various stable branch patches.
Affected products
- OpenStack Zaqar >=12.0.0 <20.1.1, 21.0.0, 22.0.0
Timeline
- 2026-07-19: disclosed: Bug reported to OpenStack Launchpad
- 2026-07-23: advisory: OpenStack Security Advisory OSSA-2026-029 published
- 2026-07-24: patched: CVE published and patches released for multiple branches