September 2026 - OpenStack-announce

OpenStack 2026.2 "Hibiscus" is officially released!
by Elõd Illés 30 Sep '26

30 Sep '26

Hello OpenStack community, I'm excited to announce the final releases for the components of OpenStack 2026.2 "Hibiscus", which conclude the 2026.2 "Hibiscus" development cycle. You will find a complete list of all components, their latest versions, and links to individual project release notes documents listed on the new release site. https://releases.openstack.org/hibiscus/ Congratulations to all of the teams who have contributed to this release! Our next production cycle, 2027.1 "Indri", has already started. We will meet in 12-16 October, 2026 virtually at the Project Team Gathering to plan the work for the upcoming cycle. I hope to see you there! Thanks, Előd Illés on behalf of the Release Management team

1 0

[OSSA-2026-042] OpenStack Zaqar: Zaqar empty URL-Signature header bypasses authentication (CVE-2026-97404)
by Goutham Pacha Ravi 24 Sep '26

24 Sep '26

======================================================================= OSSA-2026-042: Zaqar empty URL-Signature header bypasses authentication ======================================================================= :Date: September 24, 2026 :CVE: CVE-2026-97404 Affects ~~~~~~~ - Zaqar: >=1.0.0 <20.1.2, >=21.0.0 <21.0.2, >=22.0.0 <22.0.2 Description ~~~~~~~~~~~ pple, an independent security researcher, reported that Zaqar's WSGI transport mishandles an empty URL-Signature header: a request carrying the header with an empty value bypasses both Keystone authentication and pre-signed URL verification. An unauthenticated remote attacker who knows a target project's UUID can then read, enumerate, create, and delete that project's queues, messages, claims, and subscriptions. By additionally claiming an administrative role, the attacker may also perform administrative operations, such as managing pools and flavors in admin_mode deployments. Only deployments using the WSGI transport with an authentication strategy configured are affected; the websocket transport is not affected. Patches ~~~~~~~ - https://review.opendev.org/1007162 (2025.1/epoxy) - https://review.opendev.org/1007161 (2025.2/flamingo) - https://review.opendev.org/1007160 (2026.1/gazpacho) - https://review.opendev.org/1007159 (2026.2/hibiscus) - https://review.opendev.org/1007158 (2027.1/indri (development)) Credits ~~~~~~~ - pple from Independent (CVE-2026-97404) References ~~~~~~~~~~ - https://launchpad.net/bugs/2164987 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97404 Notes ~~~~~ - This issue is distinct from the EXTRA-SPEC header bypass in OSSA-2026-029; the fix for that issue removed the EXTRA-SPEC branch but left the empty-value handling of the URL-Signature header untouched. -- Goutham Pacha Ravi OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html

1 0

[OSSA-2026-041] OpenStack Swift: Cross-container information disclosure via Swift tempurl (CVE-2026-97149)
by Goutham Pacha Ravi 24 Sep '26

24 Sep '26

======================================================================= OSSA-2026-041: Cross-container information disclosure via Swift tempurl ======================================================================= :Date: September 24, 2026 :CVE: CVE-2026-97149 Affects ~~~~~~~ - Swift: >=1.4.6 <2.35.5, >=2.36.0 <2.36.4, >=2.37.0 <2.37.4, >=2.38.0 <2.38.2 Description ~~~~~~~~~~~ Oren Yomtov from ACT Security and "swdb", a security researcher, independently reported a vulnerability in the Swift tempurl middleware. A party holding a single-object PUT TempURL signed with an account-level key (``X-Account-Meta-Temp-URL-Key``) could resend the signed request with an ``X-Copy-From`` header naming any object in the same account, causing Swift to copy the named object into the granted destination object, and read the copied bytes back with a second GET TempURL, disclosing objects the holder of the TempURL was not authorized to access. Only deployments with the tempurl middleware enabled are affected. The copy is limited to the account that owns the key, and the attacker must know the target container and object name. As a mitigation, operators can add ``x-copy-from`` to the ``incoming_remove_headers`` option of the ``[filter:tempurl]`` section of their proxy server configuration. With that configuration the header is silently removed and the PUT stores no data; the patches below instead reject the request with a 400 response. Patches ~~~~~~~ - https://review.opendev.org/1007050 (2025.1/epoxy) - https://review.opendev.org/1007049 (2025.2/flamingo) - https://review.opendev.org/1007048 (2026.1/gazpacho) - https://review.opendev.org/1007047 (2026.2/hibiscus) - https://review.opendev.org/1007046 (2027.1/indri (development)) Credits ~~~~~~~ - Oren Yomtov from ACT Security - swdb from Independent References ~~~~~~~~~~ - https://launchpad.net/bugs/2166876 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97149 Notes ~~~~~ - This issue is distinct from the S3API vulnerabilities in OSSA-2026-030; it affects the native Swift API with the default proxy pipeline and does not require the S3API middleware or the ``s3_acl`` configuration. -- Goutham Pacha Ravi OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html

1 0

[OSSA-2026-039] OpenStack Octavia: HAProxy configuration injection leading to remote code execution in Octavia (CVE-2026-pending)
by Goutham Pacha Ravi 21 Sep '26

21 Sep '26

========================================================================================== OSSA-2026-039: HAProxy configuration injection leading to remote code execution in Octavia ========================================================================================== :Date: September 21, 2026 :CVE: CVE-2026-pending, CVE-2026-pending Affects ~~~~~~~ - Octavia: >=0.8.0 <16.1.0, ==17.0.0, ==18.0.0 Description ~~~~~~~~~~~ Chen YuXiang from the Institute of Computing Technology, Chinese Academy of Sciences reported input validation flaws in the Octavia load balancer API. The listener and pool ``tls_ciphers`` fields and the L7 policy ``redirect_url`` and ``redirect_prefix`` fields were written into the HAProxy configuration generated on the amphora without rejecting control characters, allowing an authenticated user who owns a load balancer managed by OpenStack Octavia's Amphora provider to inject arbitrary HAProxy configuration directives. Subsequently, an independent reporter, "Rolix", demonstrated that these flaws can be exploited to execute arbitrary commands as root on the provider-managed amphora, to disclose other tenants' TLS private keys and certificates and the deployment heartbeat key stored on the amphora, and to reach the control-plane network to which the amphora is attached. Only the Amphora provider driver is affected. Deployments that use a different provider driver do not render tenant input into an HAProxy configuration and are not affected. Patches ~~~~~~~ - https://review.opendev.org/1001096 (2025.1/epoxy) - https://review.opendev.org/1001097 (2025.1/epoxy) - https://review.opendev.org/1001094 (2025.2/flamingo) - https://review.opendev.org/1001095 (2025.2/flamingo) - https://review.opendev.org/1001091 (2026.1/gazpacho) - https://review.opendev.org/1001092 (2026.1/gazpacho) - https://review.opendev.org/999553 (2026.2/hibiscus) - https://review.opendev.org/999555 (2026.2/hibiscus) Credits ~~~~~~~ - Chen YuXiang from Institute of Computing Technology, Chinese Academy of Sciences - "Rolix" from Independent References ~~~~~~~~~~ - https://launchpad.net/bugs/2167565 - https://launchpad.net/bugs/2162101 - https://launchpad.net/bugs/2162103 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-pending - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-pending Notes ~~~~~ - Two changes are required on each branch: one fixes the ``tls_ciphers`` fields and one fixes the L7 policy redirect fields. - The listener and pool ``tls_ciphers`` fields were introduced in Octavia 6.0.0. Releases within the affected range that predate 6.0.0 are vulnerable only through the L7 policy ``redirect_url`` and ``redirect_prefix`` fields. - These issues were originally triaged as a low-severity hardening opportunity and the fixes were developed and merged in public. They were reclassified after a proof of concept demonstrated remote code execution as root on the amphora and reachability of the control-plane network. - The remote code execution issue was reported to the OpenStack VMT by Thomas Goirand (zigo) of Infomaniak, on behalf of the reporter, "Rolix". - CVE identifiers were requested from MITRE for these two vulnerabilities on 2026-09-17. The CVEs will be added to this advisory by errata once assigned. -- Goutham Pacha Ravi OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html

1 1

[OSSA-2026-040] OpenStack Blazar: Multiple authorization vulnerabilities in the Blazar V2 lease API (CVE-2026-93852, CVE-2026-93854)
by Goutham Pacha Ravi 21 Sep '26

21 Sep '26

================================================================================ OSSA-2026-040: Multiple authorization vulnerabilities in the Blazar V2 lease API ================================================================================ :Date: September 21, 2026 :CVE: CVE-2026-93852, CVE-2026-93854 Affects ~~~~~~~ - Blazar: >=1.0.0 <15.1.1, ==16.0.0, ==17.0.0 Description ~~~~~~~~~~~ Rohan Das from the University of Engineering and Management, Kolkata, reported that the Blazar V2 lease API does not enforce object-level authorization on its update and delete operations. As a result, any authenticated user who knows a lease ID can modify or delete leases belonging to other users and projects. The same reporter found that the Blazar V2 lease listing operation returns leases for every project without enforcing project scoping or an administrator-only policy. Any authenticated user can enumerate other projects' leases, exposing lease and reservation identifiers along with reservation metadata. The exposed identifiers enable the object-level authorization bypass described above, allowing an attacker to then modify or delete the enumerated leases. Only deployments that enable Blazar's V2 lease API are affected. Deployers that do not use the V2 API endpoint can set ``api_v2_controllers`` to an empty value in the ``[api]`` section of ``blazar.conf``. Patches below address the issue if the API controllers cannot be disabled. Patches ~~~~~~~ - https://review.opendev.org/1006053 (2025.1/epoxy) - https://review.opendev.org/1006052 (2025.2/flamingo) - https://review.opendev.org/1006051 (2026.1/gazpacho) - https://review.opendev.org/1006050 (2026.2/hibiscus) - https://review.opendev.org/1006049 (2027.1/indri (development)) Credits ~~~~~~~ - Rohan Das from University of Engineering and Management, Kolkata References ~~~~~~~~~~ - https://launchpad.net/bugs/2162719 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93852 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93854 Notes ~~~~~ - A single patch on each branch fixes both vulnerabilities. -- Goutham Pacha Ravi OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html

1 0

[all][elections][tc] 2027.1 Technical Committee Election Results
by Ian Y. Choi 17 Sep '26

17 Sep '26

Please join me in congratulating the 4 newly elected members of the Technical Committee (TC). Artem Goncharov (gtema) Christian Berendt (berendt) Doug Goldstein (cardoe) Dr. Jens Harbott (frickler) Full results: https://civs1.civs.us/cgi-bin/results.pl?id=E_ba65f3841b999226 Election process details and results are also available here: https://governance.openstack.org/election/ Thank you to all of the candidates, having a good group of candidates helps engage the community in our democratic process. Thank you to all who voted and who encouraged others to vote. We need to ensure your voice is heard. Thank you for another great round.

1 0

[OSSA-2026-038] OpenStack Glance: Multiple SSRF vulnerabilities in web-download and HTTP image APIs (CVE-2026-71196, CVE-2026-71197, CVE-2026-71198)
by Goutham Pacha Ravi 03 Sep '26

03 Sep '26

======================================================================================= OSSA-2026-038: Multiple SSRF vulnerabilities in Glance web-download and HTTP image APIs ======================================================================================= :Date: September 03, 2026 :CVE: CVE-2026-71196, CVE-2026-71197, CVE-2026-71198 Affects ~~~~~~~ - Glance: >=16.0.0 <30.2.1, >=31.0.0 <31.1.1, >=32.0.0 <32.0.1 Description ~~~~~~~~~~~ Sergey Kanibor (Luntry), Sami Yessou (switch.ch), and Abhishek Kekane (Red Hat) reported three related SSRF vulnerabilities in OpenStack Glance. The web-download import method ships with insecure default filtering that permits authenticated users to fetch arbitrary internal URLs, including cloud metadata endpoints. The URI validator does not perform DNS resolution before applying host filters, enabling bypass via attacker-controlled domains and DNS rebinding attacks. The HTTP image location API lacks host filtering entirely when the HTTP store is enabled, and fetched content is stored as image data accessible for download, converting blind SSRF into full-read exfiltration. All Glance deployments using the web-download import method or HTTP image location APIs are affected. Patches ~~~~~~~ - https://review.opendev.org/1003822 (2025.1/epoxy) - https://review.opendev.org/1003823 (2025.1/epoxy) - https://review.opendev.org/1003824 (2025.1/epoxy) - https://review.opendev.org/1003825 (2025.1/epoxy) - https://review.opendev.org/1003816 (2025.2/flamingo) - https://review.opendev.org/1003817 (2025.2/flamingo) - https://review.opendev.org/1003818 (2025.2/flamingo) - https://review.opendev.org/1003819 (2025.2/flamingo) - https://review.opendev.org/1003812 (2026.1/gazpacho) - https://review.opendev.org/1003813 (2026.1/gazpacho) - https://review.opendev.org/1003814 (2026.1/gazpacho) - https://review.opendev.org/1003815 (2026.1/gazpacho) - https://review.opendev.org/1003805 (2026.2/hibiscus (development)) - https://review.opendev.org/1003806 (2026.2/hibiscus (development)) - https://review.opendev.org/1003807 (2026.2/hibiscus (development)) - https://review.opendev.org/1003808 (2026.2/hibiscus (development)) Credits ~~~~~~~ - Sergey Kanibor from Luntry (CVE-2026-71196, CVE-2026-71197) - Sami Yessou from switch.ch (CVE-2026-71196) - Abhishek Kekane from Red Hat (CVE-2026-71198) References ~~~~~~~~~~ - https://launchpad.net/bugs/2158998 - https://launchpad.net/bugs/2158999 - https://launchpad.net/bugs/2161330 - https://launchpad.net/bugs/2160020 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-71196 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-71197 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-71198 Notes ~~~~~ - All four commits in each patch set are interdependent and must be applied together, in the order listed above, as each builds on the previous. The DoS issue (LP#2160020) is addressed as part of this coordinated fix. - A related Tempest test compatibility fix was proposed at https://review.opendev.org/1003560 -- Goutham Pacha Ravi OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html

1 0