This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-66139 →

DEBIAN-CVE-2026-66139

OpenStack Zaqar through 22.0.0 allows authentication bypass via an EXTRA-SPEC header when a UUID is known.

Original description

The description as published by the source.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Debian:12 zaqar

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 zaqar

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 zaqar

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.0.0-3"}]}]