CVE-2026-66139 OpenStack Zaqar through 22.0.0 allows authentication bypass via an EXTRA-SPEC header when a UUID is known

Description

OpenStack Zaqar through 22.0.0 allows authentication bypass via an EXTRA-SPEC header when a UUID is known.

Produits et versions touchés

Produit	Versions touchées	Corrigé en
Zaqar	22.0.0	Pas de correctif indiqué
Zaqar	21.0.0	Pas de correctif indiqué
Zaqar 12.0	12.0.0 → < 20.1.1	20.1.1

Autres CVE de Zaqar

Les 3 CVE de Zaqar →

CVE-2026-107363 In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to… 6.1 Moyenne CVE-2026-97404 In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header 9.2 Critique