CVE-2026-66139 is a vulnerability in OpenStack Zaqar up to version 22.0.0 where an attacker can bypass authentication by exploiting the handling of an EXTRA-SPEC header if they know a valid UUID. This represents a missing authentication control on a critical function, potentially allowing unauthorized access. The vulnerability has not been reported as exploited in the wild and no official remediation or patch has been documented as of the publication date.

The vulnerability allows an attacker with knowledge of a UUID to bypass authentication controls, potentially leading to unauthorized access to Zaqar messaging functions. The impact is limited to confidentiality and availability with no integrity impact reported. The CVSS score of 4.8 reflects a medium severity risk due to the network attack vector and the requirement for knowledge of a UUID.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround has been documented. Users should monitor OpenStack Zaqar vendor advisories for updates and consider restricting access to Zaqar endpoints to trusted networks until a fix is available.