CVE-2026-66139: CWE-306 Missing Authentication for Critical Function in OpenStack Zaqar
OpenStack Zaqar versions 12.0.0, 21.0.0, and 22.0.0 contain a vulnerability (CWE-306) that allows authentication bypass via an EXTRA-SPEC header when a UUID is known. This flaw permits unauthorized access to critical functions without proper authentication. The vulnerability has a medium severity with a CVSS score of 4.8.
AI Analysis
Technical Summary
CVE-2026-66139 describes a missing authentication vulnerability in OpenStack Zaqar up to version 22.0.0. Specifically, an attacker who knows a valid UUID can bypass authentication by exploiting the EXTRA-SPEC header, gaining unauthorized access to critical functions. This issue is classified under CWE-306 (Missing Authentication for Critical Function). No official patch or remediation guidance is provided in the available data.
Potential Impact
The vulnerability allows an attacker with knowledge of a UUID to bypass authentication controls and access critical functions in OpenStack Zaqar. The impact is limited to confidentiality and availability with no integrity impact reported. The CVSS score of 4.8 reflects a medium severity, indicating a moderate risk of unauthorized access and potential service disruption.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is documented, users should monitor OpenStack Zaqar vendor communications for updates and consider restricting access to known UUIDs or sensitive interfaces as a temporary measure.
CVE-2026-66139: CWE-306 Missing Authentication for Critical Function in OpenStack Zaqar
Description
OpenStack Zaqar versions 12.0.0, 21.0.0, and 22.0.0 contain a vulnerability (CWE-306) that allows authentication bypass via an EXTRA-SPEC header when a UUID is known. This flaw permits unauthorized access to critical functions without proper authentication. The vulnerability has a medium severity with a CVSS score of 4.8.
CVSS v3.1
Score 4.8medium
Affected software
pkg:github/openstack/zaqarRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-66139 describes a missing authentication vulnerability in OpenStack Zaqar up to version 22.0.0. Specifically, an attacker who knows a valid UUID can bypass authentication by exploiting the EXTRA-SPEC header, gaining unauthorized access to critical functions. This issue is classified under CWE-306 (Missing Authentication for Critical Function). No official patch or remediation guidance is provided in the available data.
Potential Impact
The vulnerability allows an attacker with knowledge of a UUID to bypass authentication controls and access critical functions in OpenStack Zaqar. The impact is limited to confidentiality and availability with no integrity impact reported. The CVSS score of 4.8 reflects a medium severity, indicating a moderate risk of unauthorized access and potential service disruption.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is documented, users should monitor OpenStack Zaqar vendor communications for updates and consider restricting access to known UUIDs or sensitive interfaces as a temporary measure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mitre
- Date Reserved
- 2026-07-24T04:14:41.411Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a62ef9d9c2644c7f84f6d38
Added to database: 07/24/2026, 04:52:45 UTC
Last enriched: 07/24/2026, 05:07:05 UTC
Last updated: 07/24/2026, 05:20:42 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.