July 2026 - openstack-discuss - lists.openstack.org

[debian][security] End of support for Victoria, Wallaby, Xena, Yoga on top of Debian Bullseye
by Thomas Goirand 29 Jul '26

29 Jul '26

Dear OpenStack Debian users, As Debian 11, aka Bullseye, is getting out of LTS support from Debian, I'm hereby also announcing end of security support from my side for the matching OpenStack release. This means that, at some (rare) exception for very grave issues that wont be too hard to backport, I will *NOT* backport security patches for Victoria, Wallaby, Xena and Yoga. I will continue to support Zed, including in Bullseye, through the usual backport repository at osbpo.debian.net. If you're running Debian Bullseye with Victoria, Wallaby, Xena, Yoga, I very much strongly encourage upgrading to a supported version, preferably at least bookworm-zed. As a reminder, I am tracking CVEs, OSSA and OSSN backports at: https://wiki.debian.org/OpenStack/CVE-2026 This doesn't show what I also backported to Bullseye, like the fix for CVE-2026-43001 and friends (OSSA-2026-015), as it wouldn't fit on a decently large screen, but some have been done. I strongly also encourage the use of the osbpo.debian.net repository even for OpenStack releases maintained in Debian Stable or oldstable, as it takes more time for security fixes to reach official repositories, than it takes me to just push fixes to the unofficial repositories (which is fully automated backport builds). If you haven't done so, these backports repositories can be activated with extrepo. For example, for Epoxy on top of Trixie: apt-get install extrepo extrepo enable openstack_epoxy apt-get update Last thing: I'm currently working on OSSA-2026-027 to OSSA-2026-031. Fixes for them should be available today on all supported versions of OpenStack. Best regards, Thomas Goirand (zigo)

1 0

[ops][largescale-sig][scientific-sig][publiccloud-sig] Ops Radio Hour on July 31st 2026
by Ildiko Vancsa 28 Jul '26

28 Jul '26

Hi OpenStack community, I'm reaching out to you with a friendly reminder that the next OpenStack Ops Radio Hour[1] is scheduled to happen on __July 31st, 2026 at 1300UTC,__ which is this Friday! The call series is a casual setting for operators, engineers, and contributors to come together, share knowledge, and collaborate on the complexities of managing and deploying OpenStack environments. This week’s main meeting topic is to check out recent updates to the Operator's Contributor Guide, and identify some more work to do on it or other operator-focused materials. What other topics do y’all have to discuss on the upcoming call? If you have further topics you would like to dive into during the call, please add them to this etherpad: https://etherpad.opendev.org/p/openstack_ops_radiohour Additional reminders: - Hop into the OpenStack Ops Matrix room to chat between calls: https://matrix.to/#/#openstack-ops:opendev.org See you on the call on July 31st! Bets Regards, Ildikó [1] https://wiki.openstack.org/wiki/Operations/Meetups

1 0

[skyline] Preserve original client IP in server-side API requests
by Ilia Petrov 28 Jul '26

28 Jul '26

Hi all, I am investigating a change to skyline-apiserver to preserve the original client IP address when it makes server-side requests to other OpenStack services. The main motivation is Keystone audit logging and related security controls. Horizon handles a similar case by passing the client address through keystoneauth1.Session(original_ip=...). I first discussed this with Wu Wenxiang, who suggested bringing the design to openstack-discuss before filing a Launchpad bug and preparing a patch. The proposed initial approach is: - Add an optional configuration setting containing the name of a trusted HTTP header with a sanitized single client address. - Do not parse or forward a complete X-Forwarded-For chain in Skyline. - Fall back to request.client.host when the option is unset or the configured header is absent. - Pass the resulting address to keystoneauth1.Session(original_ip=...). This keeps proxy-chain validation and header sanitization in nginx or another edge proxy rather than implementing trusted-proxy resolution inside Skyline. I would appreciate feedback on the following details: 1. Does this trust model fit existing Skyline deployments? 2. Would a configuration option similar to Horizon's SECURE_PROXY_ADDR_HEADER be appropriate? 3. Should the address be applied to both user-scoped sessions and system-scoped sessions created while handling a user request? 4. Would deployment tooling such as Kolla-Ansible need a follow-up change to expose this option and provide a sanitized header? After the discussion, I plan to file a Launchpad bug and prepare a skyline-apiserver patch with unit tests and configuration documentation. Best regards, Ilia Petrov

1 0

[tc][all] OpenStack Technical Committee Weekly Summary and Meeting Agenda (2026.2/R-9)
by Goutham Pacha Ravi 27 Jul '26

27 Jul '26

Hello Stackers, We're nine weeks away from the date of the coordinated release of OpenStack 2026.2 "Hibiscus" [1]. TC and PTL nominations for the 2027.1 "Indri" cycle open on August 5 [2]. During these elections, the community will be electing PTLs for most OpenStack project teams. There are also four Technical Committee seats that will be open. I would like to especially encourage TC nominations; it's a great place to make a wider impact on our community. If you'd like to know more about the role, please find us on OFTC's #openstack-tc IRC channel, or, reach out to any current TC member [3]. In preparation for these elections, we polled project teams that follow the Distributed Project Team leadership model if they would like to keep this governance model going into the next release cycle. All five teams (Ironic, Oslo, Release Management, Requirements and Freezer) have confirmed they want to continue; and some teams took the opportunity to switch liaisons. In the last couple of days, the OpenStack TC merged the proposal to establish the Contributor Experience Working Group. The group is organizing, and if you'd like to join the effort, please add your name to the group's wiki page [4]. We also merged a house rules update that lets routine liaison changes (release, security, and similar) land without a full roll-call vote [5]. The release team has drafted the Indri cycle schedule [6]; community input closes this Friday, July 31. So far, the release team discussed the slightly shorter length for the release, and the 4-week gap between milestones 2 and 3. Scheduling OpenStack releases is an art as much as it is a science, and we're playing tetris to accommodate popular holidays or events that affect our community's availability. I admire how each release is still well staffed, and on time. === Weekly Meeting === The last weekly meeting of the OpenStack Technical Committee was held on July 21, 2026 [7]. Most of the meeting focused on the reviewers-as-AC proposal from Dr. Jens Harbott (frickler). Jeremy Stanley (fungi) described the planned implementation: the election tooling will count accounts that actually exercised maintainer privileges (Code-Review +2/-2 or Workflow +1) during the cycle, rather than enumerating everyone who could. We identified some improvements for the proposal and no objections were noted. We also touched on the DPL resets, the puppet-vitrage retirement (now merged), and crowd-sourcing updates to the security liaison seed data [8]. In open discussion, Amy Marrich (spotz) reminded everyone that the CFP for OpenInfra Days North America is open [9]. The next meeting of the OpenStack TC is Tuesday July 28, 2026, at 1700 UTC. This meeting will be hosted on the #openstack-tc channel on OFTC. Please see the agenda on the meeting's wiki page [10]. I hope to see you there. === Governance Proposals === ==== Merged ==== - Establish Contributor Experience Working Group | https://review.opendev.org/c/openstack/governance/+/994046 - Allow liaison changes without roll call votes | https://review.opendev.org/c/openstack/governance/+/997284 - Retire puppet-vitrage | https://review.opendev.org/c/openstack/governance/+/996036 - Remove Saad Zaher from Freezer liaisons | https://review.opendev.org/c/openstack/governance/+/998413 - Update security liaison for release team | https://review.opendev.org/c/openstack/governance/+/998472 ==== Open for Review ==== - Add reviewers as Active Contributors | https://review.opendev.org/c/openstack/governance/+/995535 - Clarify CEWG mandate wording | https://review.opendev.org/c/openstack/governance/+/998680 - Add Rust use-case analysis for Keystone | https://review.opendev.org/c/openstack/governance/+/998652 - Seed security liaison data from VMT wiki | https://review.opendev.org/c/openstack/governance/+/996563 - Define testing runtime for 2027.1 release | https://review.opendev.org/c/openstack/governance/+/996925 - Retire barbican's ansible roles | https://review.opendev.org/c/openstack/governance/+/995081 - Move schemas into their own directory | https://review.opendev.org/c/openstack/governance/+/993955 - Add schemas for other reference files | https://review.opendev.org/c/openstack/governance/+/993956 - Start testing pre-release versions for clients and libraries | https://review.opendev.org/c/openstack/governance/+/992767 - Distinguish between tested runtimes for clients and libraries | https://review.opendev.org/c/openstack/governance/+/992765 === Upcoming Events === - 2026-07-29: KubeCon + CloudNativeCon Japan: https://events.linuxfoundation.org/kubecon-cloudnativecon-japan/ - 2026-08-11: OpenInfra Board Meeting: https://board.openinfra.org/ - 2026-08-29: OpenInfra Day Nigeria: https://www.meetup.com/openstack-nigeria-user-group/events/313525373/ - 2026-09-01: KCD x Ceph x OpenInfra Day Korea: https://community2.cncf.io/events/details/cncf-kcd-south-korea-presents-kcd… - 2026-09-04: OpenInfra Day Kenya: https://www.meetup.com/openinfra-user-group-kenya/events/315616588/ Thank you very much for reading! On behalf of the OpenStack TC, Goutham Pacha Ravi (gouthamr) OpenStack TC Chair [1] 2026.2 "Hibiscus" Release Schedule: https://releases.openstack.org/hibiscus/schedule.html [2] 2027.1 Election Timeline: https://governance.openstack.org/election/ [3] Current TC Members: https://governance.openstack.org/tc/#current-members [4] Contributor Experience Working Group Wiki: https://wiki.openstack.org/wiki/Contributor_Experience_WG [5] Allow Liaison Changes Without Roll-Call Votes: https://review.opendev.org/c/openstack/governance/+/997284 [6] Indri Release Schedule Draft: https://lists.openstack.org/archives/list/openstack-discuss@lists.openstack… [7] TC Meeting IRC Log, July 21 2026: https://meetings.opendev.org/meetings/tc/2026/tc.2026-07-21-17.01.html [8] Seed Security Liaison Data from VMT Wiki: https://review.opendev.org/c/openstack/governance/+/996563 [9] OpenInfra Days North America CFP: https://sessionize.com/OpenInfra2026/ [10] TC Meeting Agenda, July 28 2026: https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee#Next_Meeting

1 0

[ironic] CWI deliverables without release in 2026.2 Hibiscus so far
by Elõd Illés 27 Jul '26

27 Jul '26

Hi Ironic team, This is just a heads-up, that the following cycle-with-intermediery deliverables (non-library) have not been released this cycle yet: * ironic-prometheus-exporter * ironic-python-agent-builder * ironic-ui * networking-baremetal Do you plan to propose release patches for them? Thanks, Előd Illés IRC: elodilles @ #openstack-release

2 1

Servers in Ubuntu 26 Compute Host OS network has no routes
by Ahmad Milad Pour 26 Jul '26

26 Jul '26

Hello there, I have an issue only when I do reinstall my test stage (both compute node and region node) to Ubuntu 26, I have multiple issues in the VMs: How I install packages on region: ``` crudini --set /etc/neutron/neutron.conf DEFAULT bind_host $main_ip crudini --set /etc/neutron/neutron.conf DEFAULT bind_port 9696 crudini --set /etc/neutron/neutron.conf DEFAULT core_plugin ml2 crudini --set /etc/neutron/neutron.conf DEFAULT service_plugins router,qos crudini --set /etc/neutron/neutron.conf DEFAULT allow_overlapping_ips true crudini --set /etc/neutron/neutron.conf DEFAULT transport_url rabbit://openstack:$rabbitmq_password@$HOSTNAME crudini --set /etc/neutron/neutron.conf DEFAULT auth_strategy keystone crudini --set /etc/neutron/neutron.conf DEFAULT notify_nova_on_port_status_changes true crudini --set /etc/neutron/neutron.conf DEFAULT notify_nova_on_port_data_changes true crudini --set /etc/neutron/neutron.conf database connection mysql+pymysql://neutron:$neutron_database_password@localhost/neutron crudini --set /etc/neutron/neutron.conf keystone_authtoken www_authenticate_uri http://$HOSTNAME:5000 crudini --set /etc/neutron/neutron.conf keystone_authtoken auth_url http:// $HOSTNAME:5000 crudini --set /etc/neutron/neutron.conf keystone_authtoken memcached_servers $HOSTNAME:11211 crudini --set /etc/neutron/neutron.conf keystone_authtoken memcache_sasl_enabled true crudini --set /etc/neutron/neutron.conf keystone_authtoken memcache_username memcached crudini --set /etc/neutron/neutron.conf keystone_authtoken memcache_password "$memcached_password" crudini --set /etc/neutron/neutron.conf keystone_authtoken auth_type password crudini --set /etc/neutron/neutron.conf keystone_authtoken project_domain_name Default crudini --set /etc/neutron/neutron.conf keystone_authtoken user_domain_name Default crudini --set /etc/neutron/neutron.conf keystone_authtoken project_name service crudini --set /etc/neutron/neutron.conf keystone_authtoken username neutron crudini --set /etc/neutron/neutron.conf keystone_authtoken password $neutron_password crudini --set /etc/neutron/neutron.conf nova auth_url http://$HOSTNAME:5000 crudini --set /etc/neutron/neutron.conf nova auth_type password crudini --set /etc/neutron/neutron.conf nova project_domain_name Default crudini --set /etc/neutron/neutron.conf nova user_domain_name Default crudini --set /etc/neutron/neutron.conf nova region_name $region_name crudini --set /etc/neutron/neutron.conf nova project_name service crudini --set /etc/neutron/neutron.conf nova username nova crudini --set /etc/neutron/neutron.conf nova password "${nova_password}" crudini --set /etc/neutron/neutron.conf oslo_concurrency lock_path /var/lib/neutron/tmp mkdir -p /var/lib/neutron/tmp chown neutron:neutron /var/lib/neutron/tmp chmod 755 /var/lib/neutron/tmp crudini --set /etc/neutron/neutron.conf quotas quota_network -1 crudini --set /etc/neutron/neutron.conf quotas quota_subnet -1 crudini --set /etc/neutron/neutron.conf quotas quota_port -1 crudini --set /etc/neutron/neutron.conf quotas quota_router -1 crudini --set /etc/neutron/neutron.conf quotas quota_floatingip -1 crudini --set /etc/neutron/neutron.conf quotas quota_security_group -1 crudini --set /etc/neutron/neutron.conf quotas quota_security_group_rule -1 crudini --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2 type_drivers flat,vlan,vxlan crudini --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2 tenant_network_types "vxlan" crudini --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2 extension_drivers port_security,qos crudini --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2_type_flat flat_networks "ncg1" crudini --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2_type_vxlan vni_ranges 1:1000 crudini --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2 mechanism_drivers "openvswitch,l2population" crudini --set /etc/neutron/plugins/ml2/ml2_conf.ini securitygroup enable_ipset true crudini --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2_type_vlan network_vlan_ranges "ncg1:1:4094" crudini --set /etc/neutron/plugins/ml2/ml2_conf.ini agent extensions qos crudini --set /etc/neutron/plugins/ml2/openvswitch_agent.ini ovs local_ip "$main_ip" crudini --set /etc/neutron/plugins/ml2/openvswitch_agent.ini ovs bridge_mappings "ncg1:br-provider" crudini --set /etc/neutron/plugins/ml2/openvswitch_agent.ini agent tunnel_types "vxlan" crudini --set /etc/neutron/plugins/ml2/openvswitch_agent.ini agent l2_population true crudini --set /etc/neutron/plugins/ml2/openvswitch_agent.ini securitygroup enable_security_group true crudini --set /etc/neutron/plugins/ml2/openvswitch_agent.ini securitygroup firewall_driver "iptables_hybrid" bk /etc/neutron/l3_agent.ini crudini --set /etc/neutron/l3_agent.ini DEFAULT interface_driver openvswitch crudini --set /etc/neutron/l3_agent.ini DEFAULT extensions qos crudini --set /etc/neutron/dhcp_agent.ini DEFAULT interface_driver openvswitch crudini --set /etc/neutron/dhcp_agent.ini DEFAULT dhcp_driver neutron.agent.linux.dhcp.Dnsmasq crudini --set /etc/neutron/dhcp_agent.ini DEFAULT enable_isolated_metadata true crudini --set /etc/neutron/dhcp_agent.ini DEFAULT extensions qos crudini --set /etc/neutron/metadata_agent.ini DEFAULT nova_metadata_host $HOSTNAME crudini --set /etc/neutron/metadata_agent.ini DEFAULT metadata_proxy_shared_secret $metadata_proxy_shared_secret systemctl restart neutron-ovs-cleanup sleep 1 systemctl restart neutron-metadata-agent neutron-l3-agent neutron-server neutron-ovs-cleanup openstack user create --domain default --password $neutron_password neutron openstack role add --project service --user neutron admin openstack service create --name neutron --description "OpenStack Networking" network openstack endpoint create --region $region_name network public http:// $HOSTNAME:9696 openstack endpoint create --region $region_name network internal http:// $HOSTNAME:9696 openstack endpoint create --region $region_name network admin http:// $HOSTNAME:9696 su -s /bin/sh -c "neutron-db-manage --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugins/ml2/ml2_conf.ini upgrade head" neutron ``` And in the compute node: ``` crudini --set /etc/neutron/plugins/ml2/openvswitch_agent.ini ovs local_ip "$MY_IP" crudini --set /etc/neutron/plugins/ml2/openvswitch_agent.ini agent tunnel_types "vxlan" crudini --set /etc/neutron/plugins/ml2/openvswitch_agent.ini agent l2_population true crudini --set /etc/neutron/plugins/ml2/openvswitch_agent.ini securitygroup enable_security_group true crudini --set /etc/neutron/plugins/ml2/openvswitch_agent.ini securitygroup firewall_driver "iptables_hybrid" crudini --set /etc/neutron/plugins/ml2/openvswitch_agent.ini agent extensions "qos" crudini --set /etc/neutron/plugins/ml2/openvswitch_agent.ini ovs bridge_mappings "ncg1:br-provider" crudini --set /etc/neutron/neutron.conf DEFAULT host "$HOSTNAME" crudini --set /etc/neutron/neutron.conf DEFAULT transport_url "rabbit://openstack:${rabbitmq_password}@${CONTROLLER_IP}" crudini --set /etc/neutron/neutron.conf oslo_concurrency lock_path /var/lib/neutron/tmp crudini --set /etc/neutron/metadata_agent.ini DEFAULT nova_metadata_host $CONTROLLER_IP crudini --set /etc/neutron/metadata_agent.ini DEFAULT nova_metadata_port 8774 crudini --set /etc/neutron/metadata_agent.ini DEFAULT nova_metadata_protocol http ``` When I run 'openstack server create', the server list shows it has IP, but that IP has no ping. This is inside a VM: ``` root@ubuntu:~# ip a 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host noprefixroute valid_lft forever preferred_lft forever 2: ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000 link/ether fa:16:3e:b8:83:44 brd ff:ff:ff:ff:ff:ff altname enp0s3 altname enxfa163eb88344 inet6 fe80::f816:3eff:feb8:8344/64 scope link proto kernel_ll valid_lft forever preferred_lft forever root@ubuntu:~# ip route root@ubuntu:~# cat /etc/netplan/50-cloud-init.yaml network: version: 2 ethernets: ens3: match: macaddress: "fa:16:3e:b8:83:44" dhcp4: true dhcp6: true set-name: "ens3" ``` I have another issue too, it cannot have connection with metadata service because I cannot curl 169.254.169.254. Also when I do create server with 'openstack server create --user-data userdata.yaml' to set password, the userdata password does not work and the image's default password only works. In the logs everything is fine because everything is being created, but I do not understand where the issue is. I also do create bridges in the compute node too: ``` main_ip="$(hostname -I | awk -F ' ' '{print $1}')" main_ip_with_subnet="$(ip a | grep $main_ip | awk -F ' ' '{print $2}')" interface_name="$(ip a | grep $main_ip | awk -F ' ' '{print $NF}')" gateway_ip="$(route -n | grep UG | awk -F ' ' '{print $2}')" echo "[+] Open vSwitch: create br-provider (single-NIC), migrate host IP" ovs-vsctl --may-exist add-br br-provider if ! ovs-vsctl list-ports br-provider | grep -qx "$main_ip"; then ovs-vsctl --may-exist add-port br-provider "$interface_name" || true echo ">>> Moving host IP/route to br-provider. SSH may blip for a moment." ip addr flush dev "$interface_name" || true ip link set br-provider up ip addr add "$main_ip_with_subnet" dev br-provider ip route replace default via "$gateway_ip" fi for f in /etc/netplan/*.yaml; do [ "$f" = "/etc/netplan/99-br-provider.yaml" ] || mv -v "$f" "$f.disabled" done cat <<EOF > /etc/netplan/99-br-provider.yaml network: version: 2 ethernets: ${interface_name}: dhcp4: false bridges: br-provider: interfaces: [${interface_name}] openvswitch: {} addresses: - ${main_ip_with_subnet} routes: - to: default via: ${gateway_ip} nameservers: addresses: [46.32.31.30, 8.8.8.8] parameters: stp: false forward-delay: 0 EOF chmod 0600 /etc/netplan/99-br-provider.yaml netplan apply ``` May you help/hint me how to troubleshoot more, or I should ignore Ubuntu 26 at the moment?

3 4

[OSSA-2026-029] OpenStack Zaqar: EXTRA-SPEC header bypasses Keystone authentication (CVE-2026-pending)
by Goutham Pacha Ravi 24 Jul '26

24 Jul '26

======================================================================= OSSA-2026-029: Zaqar EXTRA-SPEC header bypasses Keystone authentication ======================================================================= :Date: July 23, 2026 :CVE: CVE-2026-pending Affects ~~~~~~~ - Zaqar: >=12.0.0 <20.1.1, ==21.0.0, ==22.0.0 Description ~~~~~~~~~~~ Chen YuXiang from the Institute of Computing Technology, Chinese Academy of Sciences reported that the Zaqar messaging service bypasses Keystone authentication when an EXTRA-SPEC header is present in the request. An unauthenticated attacker who knows a project UUID can read, enumerate, create, and delete that project's queues without a Keystone token. The EXTRA-SPEC header was intended to support an alternative authentication mechanism, but the backend validation was never implemented, resulting in a complete authentication bypass. All deployments running Zaqar 12.0.0 or later are affected. Patches ~~~~~~~ - https://review.opendev.org/998272 (2026.2/hibiscus (development)) - https://review.opendev.org/998400 (2026.1/gazpacho) - https://review.opendev.org/998410 (2025.2/flamingo) - https://review.opendev.org/998411 (2025.1/epoxy) Credits ~~~~~~~ - Chen YuXiang from Institute of Computing Technology, Chinese Academy of Sciences References ~~~~~~~~~~ - https://launchpad.net/bugs/2161254 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-pending Notes ~~~~~ - A CVE assignment is pending from MITRE. This advisory will be updated when the CVE is assigned. - https://review.opendev.org/998223 proposes removing the EXTRA-SPEC feature entirely as a follow-up hardening measure. -- Goutham Pacha Ravi OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html

1 1

[OSSA-2026-027] OpenStack Ironic Python Agent: Command execution via unsanitized config (CVE-2026-pending)
by Goutham Pacha Ravi 24 Jul '26

24 Jul '26

======================================================= OSSA-2026-027: Command execution via unsanitized config ======================================================= :Date: July 23, 2026 :CVE: CVE-2026-pending Affects ~~~~~~~ - Ironic-python-agent: >=6.0.0 <10.2.3, >=11.0.0 <11.2.1, >=11.3.0 <11.5.1, ==11.6.0 Description ~~~~~~~~~~~ Dmitry Tantsur (Red Hat) and Tuomo Tanskanen (Ericsson Software Technology) from the Metal3.io Security Team reported a vulnerability in Ironic-Python-Agent's (IPAs) time syncing code. The value of the ntp_server configuration option is inserted into a shell command without sanitization. This command is run as root very early in the IPA startup flow, allowing an attacker to run arbitrary commands as root. This value can be set in three ways; directly in an operator-created ramdisk, set via kernel command line using Ironic, or passing the parameters via mDNS responder for mDNS enabled installation. For the most common, and highest security risk case, this means a Manager role associated with the project set as ``node.owner`` may be able to trigger this vulnerability. Patches ~~~~~~~ - https://review.opendev.org/998486 (2026.2/hibiscus (development)) - https://review.opendev.org/998488 (2026.1/gazpacho) - https://review.opendev.org/998489 (2025.2/flamingo) - https://review.opendev.org/998490 (2025.1/epoxy) - https://review.opendev.org/998491 (2024.1/caracal (unmaintained)) - https://review.opendev.org/998492 (2023.1/antelope (unmaintained)) - https://review.opendev.org/998487 (bugfix/11.6) - https://review.opendev.org/998482 (bugfix/11.4) - https://review.opendev.org/998483 (bugfix/11.3) Credits ~~~~~~~ - Dmitry Tantsur from Red Hat - Tuomo Tanskanen from Ericsson Software Technology References ~~~~~~~~~~ - https://launchpad.net/bugs/2160050 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-pending Notes ~~~~~ - A CVE assignment is pending from MITRE. This advisory will be updated when the CVE is assigned. - Branches 2024.1/caracal and 2023.1/antelope are unmaintained and patches are provided as a courtesy. - Bugfix branches will receive patches in git but will not receive an updated release. - While root access to a node running an Ironic workflow has security implications for that specific node, there is no known method for turning node ramdisk shell access into a full compromise of the Ironic service. -- Goutham Pacha Ravi OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html

1 1

[manila] Manila Hibiscus Mid Cycle: Jul 27 and Jul 30th
by Carlos Silva 23 Jul '26

23 Jul '26

Hello everyone, The Manila team's mid-cycle is next week. As in the mid-cycles we have hosted in the past, we will go through our planned deliverables 2026.2 Hibiscus, as well as host collaborative review sessions for the features being introduced to help speed up the review process. All sessions will be recorded and shared on the OpenStack Manila YouTube channel [2]. We will meet during the following times: - July 27th: 15:00 to 16:00 UTC - July 30th: 13:00 to 16:00 UTC We are using an etherpad to gather topics [1], so if you would like to add something to discuss with the Manila community, please feel free to update it. You can join us in this meetpad bridge [3]. This .ics file [4] contains all meeting details and can be imported into your calendar tool of preference. [1] https://etherpad.opendev.org/p/hibiscus-mid-cycle-manila [2] https://www.youtube.com/@openstackmanila [3] https://meetpad.opendev.org/hibiscus-mid-cycle-manila [4] https://gist.github.com/silvacarloss/42db2793bb666b420e428f937f2700ea Looking forward to it, carloss

1 0

[OSSA-2026-028] OpenStack Ironic Python Agent: Credential extraction via malicious container (CVE-2026-54422)
by Goutham Pacha Ravi 23 Jul '26

23 Jul '26

===================================================================================== OSSA-2026-028: Credential extraction from Ironic Python Agent via malicious container ===================================================================================== :Date: July 23, 2026 :CVE: CVE-2026-54422 Affects ~~~~~~~ - Ironic-python-agent: >=10.2.0 <10.2.3, >=11.0.0 <11.2.1, >=11.3.0 <11.5.1 Description ~~~~~~~~~~~ Yuliang Xiao reported a vulnerability in Ironic Python Agent's bootc container deployment support. A malicious container can extract the secrets used to fetch from the OCI registry on deployment. Operators can fix this issue by applying the provided patches or completely disabling the bootc deploy_interface on their Ironic conductors. Any Ironic user with the ability to deploy arbitrary containers from the bootc deploy_interface can exploit this. Patches ~~~~~~~ - https://review.opendev.org/998479 (2026.2/hibiscus (development)) - https://review.opendev.org/998481 (2026.1/gazpacho) - https://review.opendev.org/998484 (2025.2/flamingo) - https://review.opendev.org/998485 (2025.1/epoxy) - https://review.opendev.org/998480 (bugfix/11.6) - https://review.opendev.org/998493 (bugfix/11.4) - https://review.opendev.org/998494 (bugfix/11.3) Credits ~~~~~~~ - Yuliang Xiao References ~~~~~~~~~~ - https://launchpad.net/bugs/2155826 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54422 Notes ~~~~~ - Ironic Python Agent bugfix branch patches will be available in git for interested operators. We will not perform an additional release from these branches. -- Goutham Pacha Ravi OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html

1 0