CVE-2026-107363

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-107363
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107363.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-107363
Downstream
Published
2026-10-07T20:08:47Z
Modified
2026-10-11T02:46:30Z
Severity
  • 6.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
[none]
Details

In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. An authenticated user with a valid token for one project may substitute another project's UUID to enumerate, inspect, create, or delete queues belonging to that project, resulting in unauthorized disclosure, modification, or loss of queue data. Only deployments using the WebSocket transport with Keystone authentication are affected.

Database specific 
{
    "cna_assigner": "mitre",
    "cwe_ids": [
        "CWE-472"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107363.json"
}
References

Affected packages

Git / opendev.org/openstack/zaqar

Affected ranges

Type
GIT
Repo
https://opendev.org/openstack/zaqar
Events
Introduced
45df812449070d4af489fed2cedf0fe84417d298
Fixed
c4d8f5b176e61e8b0dc4164d9d14cddcc6ee934d
Introduced
245ab78e066f4224f54b477143651b20eab8d3e7
Fixed
d8619b0da97d23276c265179e985063d8970ac8a
Introduced
9e332b2b9364e0c113e35e158f7b500502ac629b
Fixed
93dbc114594eb73c0134a7f3fac446a3c2e57486
Introduced
e7d8236443b7295c996a37f91bc87270a0f1a994
Fixed
ff529ab7e60bac839ccd87b061d8d517a45dfc90
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "1.0.0"
        },
        {
            "fixed": "20.1.3"
        },
        {
            "introduced": "21.0.0"
        },
        {
            "fixed": "21.0.3"
        },
        {
            "introduced": "22.0.0"
        },
        {
            "fixed": "22.0.3"
        },
        {
            "introduced": "23.0.0"
        },
        {
            "fixed": "23.0.1"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

21.*
21.0.0
21.0.0.0rc1
21.0.1
21.0.2
22.*
22.0.0
22.0.0.0rc1
22.0.1
22.0.2
23.*
23.0.0
23.0.0.0rc2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107363.json"