The vulnerability resides in the WSGI transport of OpenStack Zaqar versions prior to 22.0.2, where the URL‑Signature header is mishandled. An unauthenticated attacker who knows the UUID of a target project can send a request with an empty URL‑Signature header to bypass Keystone authentication and pre‑signed URL checks. This grants the attacker complete reading, enumeration, creation, and deletion privileges over the project's queues, messages, claims, and subscriptions. If the attacker also claims an administrative role, they can perform higher‑level administrative operations such as managing pools and flavors in deployments using admin_mode. The flaw amounts to a full authorization bypass that could allow an attacker to take arbitrary control of a target project's messaging infrastructure.

Affected systems are deployments of OpenStack Zaqar using the WSGI transport with an authentication strategy configured. Versions before 22.0.2 are vulnerable; deployments using the websocket transport are not affected. The impact applies to the specific project identified by its UUID within the Zaqar service.

The flaw carries a CVSS score of 9.2, indicating a high‑severity threat. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, meaning there are no publicly known exploits at the time of this analysis. Based on the description, the likely attack vector is a remote HTTP request that includes an empty URL‑Signature header, requiring prior knowledge of the target project’s UUID. The attacker achieves full bypass of authentication and can perform any actions permitted by the project’s permissions, which may lead to significant confidentiality, integrity, and availability violations.