July 2026 - OpenStack-announce - lists.openstack.org

[OSSA-2026-031] OpenStack Swift: Proxy denial of service via Accept header (CVE-2026-pending)
by Goutham Pacha Ravi 05 Aug '26

05 Aug '26

============================================================== OSSA-2026-031: Swift proxy denial of service via Accept header ============================================================== :Date: July 28, 2026 :CVE: CVE-2026-pending Affects ~~~~~~~ - Swift: >=1.9.1 <2.35.4, >=2.36.0 <2.36.3, >=2.37.0 <2.37.3, ==2.38.0 Description ~~~~~~~~~~~ Christian Schwede from NVIDIA reported a denial of service vulnerability in Swift's proxy server. The Accept header parser is vulnerable to catastrophic regular expression backtracking. An unauthenticated attacker can send crafted requests that exhaust proxy worker threads, rendering the service unavailable. All deployments running Swift proxy with versions between 1.9.1 and the fixed releases listed below are affected. Patches ~~~~~~~ - https://review.opendev.org/998953 (2025.1/epoxy) - https://review.opendev.org/998952 (2025.2/flamingo) - https://review.opendev.org/998951 (2026.1/gazpacho) - https://review.opendev.org/998950 (2026.2/hibiscus (development)) Credits ~~~~~~~ - Christian Schwede from NVIDIA References ~~~~~~~~~~ - https://launchpad.net/bugs/2158771 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-pending -- Goutham Pacha Ravi OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html

1 1

[OSSA-2026-030] OpenStack Swift: S3API header authorization bypass (CVE-2026-pending)
by Goutham Pacha Ravi 05 Aug '26

05 Aug '26

====================================================== OSSA-2026-030: Swift S3API header authorization bypass ====================================================== :Date: July 28, 2026 :CVE: CVE-2026-pending, CVE-2026-pending Affects ~~~~~~~ - Swift: >=2.18.0 <2.35.4, >=2.36.0 <2.36.3, >=2.37.0 <2.37.3, ==2.38.0 Description ~~~~~~~~~~~ Christian Schwede from NVIDIA reported two authorization bypass vulnerabilities in Swift's S3API middleware. Insufficient validation of request headers allows an attacker to copy and read objects belonging to other tenants. The first issue affects the default ``s3_acl=false`` configuration; the second affects deployments with ``s3_acl=true``. Both require the attacker to know the target container and object names. All deployments using the S3API middleware with versions between 2.18.0 and the fixed releases listed below are affected. Patches ~~~~~~~ - https://review.opendev.org/998948 (2025.1/epoxy) - https://review.opendev.org/998949 (2025.1/epoxy) - https://review.opendev.org/998946 (2025.2/flamingo) - https://review.opendev.org/998947 (2025.2/flamingo) - https://review.opendev.org/998944 (2026.1/gazpacho) - https://review.opendev.org/998945 (2026.1/gazpacho) - https://review.opendev.org/998942 (2026.2/hibiscus (development)) - https://review.opendev.org/998943 (2026.2/hibiscus (development)) Credits ~~~~~~~ - Christian Schwede from NVIDIA References ~~~~~~~~~~ - https://launchpad.net/bugs/2158733 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-pending - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-pending -- Goutham Pacha Ravi OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html

1 1

[OSSA-2026-007] OpenStack Keystone: LDAP identity backend does not convert enabled attribute to boolean (CVE PENDING)
by Goutham Pacha Ravi 05 Aug '26

05 Aug '26

================================================================================== OSSA-2026-007: LDAP identity backend does not convert enabled attribute to boolean ================================================================================== :Date: April 14, 2026 :CVE: CVE-2026-pending Affects ~~~~~~~ - Keystone: >=8.0.0 <25.0.1, >=26.0.0 <26.1.1, >=27.0.0 <27.0.1, >=28.0.0 <28.0.1 Description ~~~~~~~~~~~ Benedikt Trefzer and Andrew Bogott independently reported a vulnerability in the Keystone LDAP identity backend. When the user_enabled_invert configuration option was False (the default), Keystone did not correctly interpret the LDAP enabled attribute, causing users disabled in LDAP to be treated as enabled and allowed to authenticate. Deployments using the LDAP identity backend without user_enabled_invert=True or user_enabled_emulation are affected. Patches ~~~~~~~ -https://review.opendev.org/982409 (2024.2/dalmatian) -https://review.opendev.org/982408 (2025.1/epoxy) -https://review.opendev.org/982407 (2025.2/flamingo) -https://review.opendev.org/958205 (2026.1/gazpacho) Credits ~~~~~~~ - Benedikt Trefzer from Cirrax GmbH (CVE-2026-pending) - Andrew Bogott from Wikimedia Foundation (CVE-2026-pending) - Grzegorz Grasza from Red Hat (CVE-2026-pending) References ~~~~~~~~~~ -https://launchpad.net/bugs/2121152 -https://launchpad.net/bugs/2141713 Notes ~~~~~ - To work around this vulnerability, set user_enabled_invert=True and use an LDAP attribute with inverted semantics such as nsAccountLock, or use user_enabled_emulation with group-based enabled status. - A CVE request was filed with MITRE on 2026-04-10. - The fix was merged on the master branch before the stable/2026.1 branch was cut, so no specific stable/2026.1 patch exists. The fix is included in the gazpacho (29.0.0) release. -- Goutham Pacha Ravi (gouthamr) OpenStack Vulnerability Management Team

1 1

[OSSA-2026-032] OpenStack Neutron: Subnetpool onboarding cross-project subnet mutation (CVE-2026-55707)
by Goutham Pacha Ravi 29 Jul '26

29 Jul '26

================================================================== OSSA-2026-032: Subnetpool onboarding cross-project subnet mutation ================================================================== :Date: July 29, 2026 :CVE: CVE-2026-55707 Affects ~~~~~~~ - Neutron: >=14.0.0 <26.0.6, >=27.0.0 <27.0.4, >=28.0.0 <28.0.2 Description ~~~~~~~~~~~ Tim Shephard from roiai.ca reported a vulnerability in Neutron's subnetpool onboarding API. A project member can onboard subnets from another project's shared network into their own subnetpool, mutating the victim's persistent subnet state and altering L3 routing, NAT, and address-scope behavior for victim routers. Only deployments with shared or RBAC-shared networks and the subnetpool onboarding extension enabled are affected. Patches ~~~~~~~ - https://review.opendev.org/999134 (2025.1/epoxy) - https://review.opendev.org/999133 (2025.2/flamingo) - https://review.opendev.org/999132 (2026.1/gazpacho) - https://review.opendev.org/999131 (2026.2/hibiscus (development)) Credits ~~~~~~~ - Tim Shephard from roiai.ca References ~~~~~~~~~~ - https://launchpad.net/bugs/2152113 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55707 -- Goutham Pacha Ravi OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html

1 0

[OSSA-2026-029] OpenStack Zaqar: EXTRA-SPEC header bypasses Keystone authentication (CVE-2026-pending)
by Goutham Pacha Ravi 24 Jul '26

24 Jul '26

======================================================================= OSSA-2026-029: Zaqar EXTRA-SPEC header bypasses Keystone authentication ======================================================================= :Date: July 23, 2026 :CVE: CVE-2026-pending Affects ~~~~~~~ - Zaqar: >=12.0.0 <20.1.1, ==21.0.0, ==22.0.0 Description ~~~~~~~~~~~ Chen YuXiang from the Institute of Computing Technology, Chinese Academy of Sciences reported that the Zaqar messaging service bypasses Keystone authentication when an EXTRA-SPEC header is present in the request. An unauthenticated attacker who knows a project UUID can read, enumerate, create, and delete that project's queues without a Keystone token. The EXTRA-SPEC header was intended to support an alternative authentication mechanism, but the backend validation was never implemented, resulting in a complete authentication bypass. All deployments running Zaqar 12.0.0 or later are affected. Patches ~~~~~~~ - https://review.opendev.org/998272 (2026.2/hibiscus (development)) - https://review.opendev.org/998400 (2026.1/gazpacho) - https://review.opendev.org/998410 (2025.2/flamingo) - https://review.opendev.org/998411 (2025.1/epoxy) Credits ~~~~~~~ - Chen YuXiang from Institute of Computing Technology, Chinese Academy of Sciences References ~~~~~~~~~~ - https://launchpad.net/bugs/2161254 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-pending Notes ~~~~~ - A CVE assignment is pending from MITRE. This advisory will be updated when the CVE is assigned. - https://review.opendev.org/998223 proposes removing the EXTRA-SPEC feature entirely as a follow-up hardening measure. -- Goutham Pacha Ravi OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html

1 1

[OSSA-2026-027] OpenStack Ironic Python Agent: Command execution via unsanitized config (CVE-2026-pending)
by Goutham Pacha Ravi 24 Jul '26

24 Jul '26

======================================================= OSSA-2026-027: Command execution via unsanitized config ======================================================= :Date: July 23, 2026 :CVE: CVE-2026-pending Affects ~~~~~~~ - Ironic-python-agent: >=6.0.0 <10.2.3, >=11.0.0 <11.2.1, >=11.3.0 <11.5.1, ==11.6.0 Description ~~~~~~~~~~~ Dmitry Tantsur (Red Hat) and Tuomo Tanskanen (Ericsson Software Technology) from the Metal3.io Security Team reported a vulnerability in Ironic-Python-Agent's (IPAs) time syncing code. The value of the ntp_server configuration option is inserted into a shell command without sanitization. This command is run as root very early in the IPA startup flow, allowing an attacker to run arbitrary commands as root. This value can be set in three ways; directly in an operator-created ramdisk, set via kernel command line using Ironic, or passing the parameters via mDNS responder for mDNS enabled installation. For the most common, and highest security risk case, this means a Manager role associated with the project set as ``node.owner`` may be able to trigger this vulnerability. Patches ~~~~~~~ - https://review.opendev.org/998486 (2026.2/hibiscus (development)) - https://review.opendev.org/998488 (2026.1/gazpacho) - https://review.opendev.org/998489 (2025.2/flamingo) - https://review.opendev.org/998490 (2025.1/epoxy) - https://review.opendev.org/998491 (2024.1/caracal (unmaintained)) - https://review.opendev.org/998492 (2023.1/antelope (unmaintained)) - https://review.opendev.org/998487 (bugfix/11.6) - https://review.opendev.org/998482 (bugfix/11.4) - https://review.opendev.org/998483 (bugfix/11.3) Credits ~~~~~~~ - Dmitry Tantsur from Red Hat - Tuomo Tanskanen from Ericsson Software Technology References ~~~~~~~~~~ - https://launchpad.net/bugs/2160050 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-pending Notes ~~~~~ - A CVE assignment is pending from MITRE. This advisory will be updated when the CVE is assigned. - Branches 2024.1/caracal and 2023.1/antelope are unmaintained and patches are provided as a courtesy. - Bugfix branches will receive patches in git but will not receive an updated release. - While root access to a node running an Ironic workflow has security implications for that specific node, there is no known method for turning node ramdisk shell access into a full compromise of the Ironic service. -- Goutham Pacha Ravi OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html

1 1

[OSSA-2026-028] OpenStack Ironic Python Agent: Credential extraction via malicious container (CVE-2026-54422)
by Goutham Pacha Ravi 23 Jul '26

23 Jul '26

===================================================================================== OSSA-2026-028: Credential extraction from Ironic Python Agent via malicious container ===================================================================================== :Date: July 23, 2026 :CVE: CVE-2026-54422 Affects ~~~~~~~ - Ironic-python-agent: >=10.2.0 <10.2.3, >=11.0.0 <11.2.1, >=11.3.0 <11.5.1 Description ~~~~~~~~~~~ Yuliang Xiao reported a vulnerability in Ironic Python Agent's bootc container deployment support. A malicious container can extract the secrets used to fetch from the OCI registry on deployment. Operators can fix this issue by applying the provided patches or completely disabling the bootc deploy_interface on their Ironic conductors. Any Ironic user with the ability to deploy arbitrary containers from the bootc deploy_interface can exploit this. Patches ~~~~~~~ - https://review.opendev.org/998479 (2026.2/hibiscus (development)) - https://review.opendev.org/998481 (2026.1/gazpacho) - https://review.opendev.org/998484 (2025.2/flamingo) - https://review.opendev.org/998485 (2025.1/epoxy) - https://review.opendev.org/998480 (bugfix/11.6) - https://review.opendev.org/998493 (bugfix/11.4) - https://review.opendev.org/998494 (bugfix/11.3) Credits ~~~~~~~ - Yuliang Xiao References ~~~~~~~~~~ - https://launchpad.net/bugs/2155826 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54422 Notes ~~~~~ - Ironic Python Agent bugfix branch patches will be available in git for interested operators. We will not perform an additional release from these branches. -- Goutham Pacha Ravi OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html

1 0

[security-sig][OSSN-0102] Neutron sub-resource APIs do not verify parent ownership
by Goutham Pacha Ravi 21 Jul '26

21 Jul '26

## Summary ## Several Neutron APIs that operate on sub-resources (port forwardings under floating IPs, conntrack helpers under routers) authorize the request using the parent resource ID from the URL but load the child resource by its own ID without verifying it belongs to that parent. A project member can read or modify another project's sub-resource by substituting their own parent resource ID in the URL. For conntrack helpers, deletion is also possible. The attack requires knowing the victim's sub-resource UUID, which is a random UUIDv4 that cannot be enumerated through the API. ## Affected Services / Software ## * neutron: >=13.0.0 <26.0.4, >=27.0.0 <27.0.3, ==28.0.0 ## Discussion ## The affected endpoints follow this pattern: * GET/PUT /floatingips/{fip_id}/port_forwardings/{pf_id} (DELETE is not affected; it already validates the parent) * GET/PUT/DELETE /routers/{router_id}/conntrack_helpers/{ct_id} Policy checks authorize against the parent (floating IP or router) from the URL. The plugin then loads the child by bare UUID without checking that the child's parent matches the URL parent. This allows a caller who owns one floating IP or router to operate on port forwardings or conntrack helpers belonging to a different project's floating IP or router. The mitigating factor is that the victim's sub-resource UUID cannot be discovered through the API. The list endpoints are scoped to the caller's own parent resources. An attacker would need to obtain the UUID through other means. ## Recommended Actions ## Upgrade Neutron to a version containing the fixes. ## Patches ## The following reviews contain the fixes: ### Port Forwarding (LP#2150121) ### * 2026.2/hibiscus (development): https://review.opendev.org/989624 * 2026.1/gazpacho: https://review.opendev.org/990125 * 2025.2/flamingo: https://review.opendev.org/990126 * 2025.1/epoxy: https://review.opendev.org/990127 ### Conntrack Helpers (LP#2152109) ### * 2026.2/hibiscus (development): https://review.opendev.org/991586 * 2026.1/gazpacho: https://review.opendev.org/991776 * 2025.2/flamingo: https://review.opendev.org/991777 * 2025.1/epoxy: https://review.opendev.org/991778 ## Credits ## Tim Shephard, roiai.ca ## References ## Author: Goutham Pacha Ravi, Red Hat This OSSN: https://wiki.openstack.org/wiki/OSSN/OSSN-0102 Original Launchpad bugs: - https://bugs.launchpad.net/neutron/+bug/2150121 - https://bugs.launchpad.net/neutron/+bug/2152109 Mailing List: [security-sig] tag on openstack-discuss(a)lists.openstack.org OpenStack Security: https://security.openstack.org/ CVE: none

1 0

[security-sig][OSSN-0101] Nova console WebSocket proxy Origin allow-list poisoning
by Goutham Pacha Ravi 09 Jul '26

09 Jul '26

## Summary ## The Nova console WebSocket proxy mutates a shared, process-global oslo.config allowed_origins list on every incoming request by appending the client-controlled Host header value. Because oslo.config returns a cached list object, these appends persist for the lifetime of the proxy process. This permanently weakens the cross-origin protection on the console proxy and causes unbounded memory growth. ## Affected Services / Software ## * nova: >=12.0.0 <31.3.2, >=32.0.0 <32.2.2, >=33.0.0 <33.0.3 ## Discussion ## On each request, the proxy appends the Host header to CONF.console.allowed_origins to allow the proxy's own hostname. This mutates the shared oslo.config cached list rather than operating on a copy, so any Host value ever seen is retained permanently for the life of the process. An unauthenticated attacker can inject arbitrary hostnames into the allow-list by sending requests with crafted Host headers, defeating the Origin check for all subsequent requests. The unbounded list growth also enables a slow memory exhaustion DoS. ## Recommended Actions ## Apply the provided Nova patches. The fix copies the config list before appending, so mutations do not persist across requests. ## Patches ## The following reviews contain the fix for this issue: * 2026.2/hibiscus (development): https://review.opendev.org/c/openstack/nova/+/995870 * 2026.1/gazpacho: https://review.opendev.org/c/openstack/nova/+/995956 * 2025.2/flamingo: https://review.opendev.org/c/openstack/nova/+/995957 * 2025.1/epoxy: https://review.opendev.org/c/openstack/nova/+/995958 ## Credits ## Sergey r0binak Kanibor, Luntry ## References ## Author: Goutham Pacha Ravi, Red Hat This OSSN: https://wiki.openstack.org/wiki/OSSN/OSSN-0101 Original Launchpad bug: https://bugs.launchpad.net/nova/+bug/2158919 Mailing List: [security-sig] tag on openstack-discuss(a)lists.openstack.org OpenStack Security: https://security.openstack.org/ CVE: none

1 0

[OSSA-2026-026] Ironic: Insufficient Access Controls regarding Parent/Child Nodes (CVE-2026-44918)
by Jay Faulkner 08 Jul '26

08 Jul '26

================================================================================== OSSA-2026-026: Insufficient Access Controls in Ironic regarding Parent/Child Nodes ================================================================================== :Date: July 08, 2026 :CVE: CVE-2026-44918 Affects ~~~~~~~ - Ironic: >=27.0.0 <29.0.6, >=30.0.0 <32.0.2, >=33.0.0 <35.0.2, >=36.0.0 <37.0.1 Description ~~~~~~~~~~~ Dmitry Tantsur (Red Hat) and Tuomo Tanskanen (Ericsson Software Technology) from the Metal3.io Security Team reported a vulnerability in Ironic's access control code. This OSSA represents multiple related vulnerabilities in Ironic RBAC. An authenticated project manager can change the node associated with Volume Connectors or Volume Target objects, potentially changing the project permitted to access the object. Volume Connectors contain secrets in environments configuring boot from volume with iSCSI volumes. This is tracked as bug #2150256. Objects reparented in this manner cannot be detected via inspection of the data. Operators who are concerned they may have had this occur are encouraged to perform a basic audit of node configuration, for instance, insuring the expected number of volume targets, and volume connectors are present. Additionally, a project manager with the ability to create nodes can use the UUID of a node not owned by their project as a parent node when creating a new node. This mismatched child node can then be used to impact operations on the parent, such as forcing it to power on. This is tracked as bug #2150450. Ironic now specifically checks, and requires node parents and children to have matching ``node.owner`` values. This patch contains an enhancement to Ironic's upgrade check to detect this mismatched state. Operators can use the provided ``ironic-status upgrade check`` to identify misconfigured nodes. Patches ~~~~~~~ - https://review.opendev.org/c/openstack/ironic/+/996479 (2024.1/caracal (unmaintained)) - https://review.opendev.org/c/openstack/ironic/+/996478 (2025.1/epoxy) - https://review.opendev.org/c/openstack/ironic/+/996476 (2025.2/flamingo) - https://review.opendev.org/c/openstack/ironic/+/996469 (2026.1/gazpacho) - https://review.opendev.org/c/openstack/ironic/+/996462 (2026.2/hibiscus) - https://review.opendev.org/c/openstack/ironic/+/996474 (Bugfix/33.0) - https://review.opendev.org/c/openstack/ironic/+/996471 (Bugfix/34.0) - https://review.opendev.org/c/openstack/ironic/+/996464 (Bugfix/37.0) Credits ~~~~~~~ - Dmitry Tantsur from Red Hat - Tuomo Tanskanen from Ericsson Software Technology References ~~~~~~~~~~ - https://bugs.launchpad.net/ironic/+bug/2150256 - https://bugs.launchpad.net/ironic/+bug/2150450 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44918 Notes ~~~~~ - Volume Targets and Volume Connectors only contain sensitive information in environments utilizing boot-from-volume with iSCSI volumes. - These patches also contain hardening logic to prevent this class of vulnerability in Port and Portgroup objects. This is a defense in depth measure to provide consistent errors at the API level for invalid data. - Branch 2024.1/caracal is unmaintained and patches are provided as a courtesy. - Bugfix branches will recieve patches in git but will not recieve a updated release.

1 0