Zaqar vulnerabilities
CVEs whose affected-version data names the Zaqar package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-107363Medium· 6.1PoCIn OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token
In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. An authenticated user with a valid token for one project may substi…
▾ TwilightOpenStack · ZaqarEPSS 0.46%via NVD
CVE-2026-97404Critical· 9.2In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header
In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header. By sending a request with an empty URL-Signature header, an unauthenticated remote attacker who knows a target project's UUID may bypass both Keystone …
▾ MidnightOpenStack · ZaqarEPSS 0.27%via NVD