# CVE-2026-97404

OpenStack Zaqar WSGI auth bypass via empty URL-Signature header

- Page: https://www.vulneraibility.com/cve/CVE-2026-97404
- CVSS: 9.2
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.27% (percentile 18.5)
- CISA SSVC: exploitation none, automatable no, technical impact total (assessed 2026-09-26)
- Weakness: CWE-348
- Published: 2026-09-24

## Affected versions

- OpenStack Zaqar: affected >= 1.0.0 and < 20.1.2; >= 21.0.0 and < 21.0.2; >= 22.0.0 and < 22.0.2

A version outside these ranges is not a statement that it is unaffected.

## Impact

Unauthenticated attacker bypasses Keystone and presigned-URL checks to read, enumerate, create, delete project queues/messages/claims/subscriptions; may perform admin ops (manage pools/flavors).

## Action

Immediate action required

## Recommendation

Upgrade Zaqar to 22.0.2 or apply vendor patch; restrict/limit access to Zaqar endpoints.

## References

- [other] https://launchpad.net/bugs/2164987
- [other] http://www.openwall.com/lists/oss-security/2026/09/24/6

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.