In OpenStack Zaqar versions prior to 22.0.2, the WSGI transport mishandles the URL-Signature header. Specifically, sending a request with an empty URL-Signature header allows an unauthenticated attacker who knows a project's UUID to bypass Keystone authentication and pre-signed URL verification. This vulnerability permits unauthorized access to project resources including queues, messages, claims, and subscriptions. Additionally, attackers claiming administrative roles can perform administrative tasks such as managing pools and flavors in admin_mode deployments. Only deployments using WSGI transport with an authentication strategy are affected; websocket transport is not vulnerable.

An unauthenticated remote attacker can bypass authentication and authorization controls, leading to unauthorized read, enumeration, creation, and deletion of project resources in OpenStack Zaqar. In deployments with admin_mode enabled, attackers with administrative role claims can perform privileged administrative operations. This poses a critical risk to confidentiality, integrity, and availability of affected OpenStack Zaqar projects.

A fix is available in OpenStack Zaqar version 22.0.2 and later. Users should upgrade to version 22.0.2 or newer to remediate this vulnerability. Deployments using the websocket transport are not affected. Until upgraded, restrict access to the WSGI transport and ensure that authentication strategies are properly configured to minimize exposure.