A successful login is not proof that every subsequent action is authorized. CVE-2026-107363 exposes that distinction in OpenStack Zaqar. A Keystone-authenticated WebSocket session could accept a later message naming a different project, allowing access to that project's queues when its UUID is known. For shared cloud infrastructure, the boundary that matters is often enforced after authentication, not at the login screen. In practical terms, it is a good time to: • Identify Zaqar endpoints using both WebSocket transport and Keystone authentication. • Test whether an authenticated test account can reference a separate test project's queues. • Compare deployed Zaqar builds with the fixed release or vendor patch for each branch. • Preserve queue-access evidence before and after remediation. How often do cloud security reviews test authorization within a persistent session rather than just at connection establishment? #OpenStack #CloudSecurity #AccessControl #LinuxSecurity https://linuxsecurity.com/news/cloud-security/openstack-zaqar-cross-project-queues