OSSA-2026-029: Zaqar EXTRA-SPEC header bypasses Keystone authentication

Date:

July 23, 2026

CVE:

CVE-2026-pending

Affects

• Zaqar: >=12.0.0 <20.1.1, ==21.0.0, ==22.0.0

Description

chen9861 reported that the Zaqar messaging service bypasses Keystone authentication when an EXTRA-SPEC header is present in the request. An unauthenticated attacker who knows a project UUID can read, enumerate, create, and delete that project’s queues without a Keystone token. The EXTRA-SPEC header was intended to support an alternative authentication mechanism, but the backend validation was never implemented, resulting in a complete authentication bypass. All deployments running Zaqar 12.0.0 or later are affected.

Patches

• https://review.opendev.org/998411 (2025.1/epoxy)

• https://review.opendev.org/998410 (2025.2/flamingo)

• https://review.opendev.org/998400 (2026.1/gazpacho)

• https://review.opendev.org/998272 (2026.2/hibiscus (development))

Credits

• Chen YuXiang from Institute of Computing Technology, Chinese Academy of Sciences

References

• https://launchpad.net/bugs/2161254

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-pending

Notes

• A CVE assignment is pending from MITRE. This advisory will be updated when the CVE is assigned.

• https://review.opendev.org/998223 proposes removing the EXTRA-SPEC feature entirely as a follow-up hardening measure.