CVE-2026-107363
Severity not reportedIn OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keyst…
In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. An authenticated user with a valid token for one project may substitute another project's UUID to enumerate, inspect, create, or delete queues belonging to that project, resulting in unauthorized disclosure, modification, or loss of queue data. Only deployments using the WebSocket transport with Keystone authentication are affected.
Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://launchpad.net/bugs/2161402 cve@mitre.org
- https://www.openwall.com/lists/oss-security/2026/10/07/30 cve@mitre.org
- http://www.openwall.com/lists/oss-security/2026/10/07/31 af854a3a-2127-422b-91ae-364da2661108
- https://launchpad.net/bugs/2161402 134c704f-9b21-4f2e-91b3-4a467353bcc0