CVE-2026-107363
In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in…
- Risk score
- 44/100
- CVSS
- 6.1 v4.0
- Exploit chance (30 days)
- 0.5%
- Published
- 7 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. An authenticated user with a valid token for one project may substitute another project's UUID to enumerate, inspect, create, or delete queues belong…
- Affected
- See advisory
- Fix
- Upgrade the product to 23.0.1 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.1 medium
References
Original description
In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. An authenticated user with a valid token for one project may substitute another project's UUID to enumerate, inspect, create, or delete queues belonging to that project, resulting in unauthorized disclosure, modification, or loss of queue data. Only deployments using the WebSocket transport with Keystone authentication are affected.
Last activity 7 Oct 2026. Patch Forecast updates every hour.