redhat/openstack-zaqar vulnerabilities

Latest redhat/openstack-zaqar CVEs

Newest publication first

1. CVE-2026-97404 zaqar: OpenStack Zaqar: authentication bypass via empty URL-Signature header

   Published 2026-09-24

   Critical·CVSS 9.2 EPSS 0.27%

   In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header. By sending a request with an empty URL-Signature header, an unauthenticated remote attacker who knows a target project's UUID may bypass both Keystone authentication and pre-signed URL verificat...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.