https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 21:20:25 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-97404 <p>In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header. By sending a request with an empty URL-Signature header, an unauthenticated remote attacker who knows a target project&#39;s UUID may bypass both Keystone authentication and pre-signed URL verification, resulting in the ability to read, enumerate, create, and delete that project&#39;s queues, messages, claims, and subscriptions. By additionally claiming an administrative role, the attacker may also perform administrative operations, such as managing pools and flavors in admin_mode deployments. Only deployments using the WSGI transport with an authentication strategy configured are affected; the websocket transport is not affected.</p> <p>In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header. By sending a request with an empty URL-Signature header, an unauthenticated remote attacker who knows a target project&#39;s UUID may bypass both Keystone authentication and pre-signed URL verification, resulting in the ability to read, enumerate, create, and delete that project&#39;s queues, messages, claims, and subscriptions. By additionally claiming an administrative role, the attacker may also perform administrative operations, such as managing pools and flavors in admin_mode deployments. Only deployments using the WSGI transport with an authentication strategy configured are affected; the websocket transport is not affected.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-97404 https://vulnerability.circl.lu/vuln/ghsa-j2hp-rfqr-h9c7 <p>In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header. By sending a request with an empty URL-Signature header, an unauthenticated remote attacker who knows a target project&#39;s UUID may bypass both Keystone authentication and pre-signed URL verification, resulting in the ability to read, enumerate, create, and delete that project&#39;s queues, messages, claims, and subscriptions. By additionally claiming an administrative role, the attacker may also perform administrative operations, such as managing pools and flavors in admin_mode deployments. Only deployments using the WSGI transport with an authentication strategy configured are affected; the websocket transport is not affected.</p> <p>In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header. By sending a request with an empty URL-Signature header, an unauthenticated remote attacker who knows a target project&#39;s UUID may bypass both Keystone authentication and pre-signed URL verification, resulting in the ability to read, enumerate, create, and delete that project&#39;s queues, messages, claims, and subscriptions. By additionally claiming an administrative role, the attacker may also perform administrative operations, such as managing pools and flavors in admin_mode deployments. Only deployments using the WSGI transport with an authentication strategy configured are affected; the websocket transport is not affected.</p> https://vulnerability.circl.lu/vuln/ghsa-j2hp-rfqr-h9c7 https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-97404 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: zaqar, Ubuntu:18.04:LTS: zaqar, Ubuntu:20.04:LTS: zaqar, Ubuntu:22.04:LTS: zaqar, Ubuntu:24.04:LTS: zaqar, Ubuntu:26.04:LTS: zaqar</p> <p>(In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Si ...)</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: zaqar, Ubuntu:18.04:LTS: zaqar, Ubuntu:20.04:LTS: zaqar, Ubuntu:22.04:LTS: zaqar, Ubuntu:24.04:LTS: zaqar, Ubuntu:26.04:LTS: zaqar</p> <p>(In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Si ...)</p> https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-97404