OpenStack Zaqar releases up to 22.0.0 contain a flaw that permits an authentication bypass when an attacker transmits a specially crafted EXTRA‑SPEC header and is already in possession of a valid UUID. The mechanism bypasses the normal credential verification process, allowing the attacker to obtain full access to the Zaqar service without legitimate credentials. The vulnerability is classified as Missing Authentication (CWE‑306).

Any deployment running OpenStack Zaqar version 22.0.0 or earlier is vulnerable when the service accepts the EXTRA‑SPEC header. The issue affects the Zaqar API endpoint that processes messaging requests and can be exposed to network hosts that can reach the service.

The CVSS score of 4.8 indicates a moderate impact, while the EPSS score of less than 1 % shows a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation has been documented. The likely attack vector is a service‑level request where an attacker includes a known UUID in the EXTRA‑SPEC header; any host that can reach the Zaqar API could potentially exploit the flaw, provided it knows a valid UUID.