▤ Stackers Network

January 17, 2026

Stackers Network Digest — January 17, 2026

24 threads · 44 messages · openstack-announce, openstack-discuss

The Big Picture

The community came fully back to life this week after the holiday break, and security led the news: a keystonemiddleware privilege-escalation CVE landed mid-week, complete with a same-day errata correcting the affected version range. Alongside it, the machinery of the next release cycle started turning — Thierry Carrez posted the proposed schedule for 2026.2 "Hibiscus" — while the OpenInfra Foundation laid out its strategic plans for the year and a new Digital Sovereignty Working Group kicked off. There were no large flame-war threads; instead the week was a broad spread of operator questions (RabbitMQ versions, Galera backups, OVN BGP, Cinder migration speed) and forward-looking coordination from the TC and OpenInfra staff.

Security

Privilege escalation in keystonemiddleware (OSSA-2026-001 / CVE-2026-22797). Jeremy Stanley announced a vulnerability reported by Grzegorz Grasza (Red Hat) in the external_oauth2_token middleware. The middleware fails to sanitize incoming authentication headers before processing OAuth 2.0 tokens, so an authenticated attacker can send forged identity headers — X-Is-Admin-Project, X-Roles, X-User-Id — to escalate privileges or impersonate other users. All deployments using the external_oauth2_token middleware are affected. The fix adds a remove_auth_headers() call at the start of request processing, matching the behavior of the main auth_token middleware. Patches are posted for caracal, dalmatian, epoxy, flamingo, and 2026.1/gazpacho. Tracking bug: LP 2129018.

A same-day errata corrected the affected version ranges: the original advisory listed >=10.0.0, but the vulnerable code wasn't introduced until keystonemiddleware 10.5.0 during the 2024.1/Caracal cycle. The corrected affected ranges are >=10.5.0 <10.7.2, >=10.8.0 <10.9.1, and >=10.10.0 <10.12.1. If you run external OAuth2 token auth, this is your action item for the week.

Releases & Announcements

2026.2 "Hibiscus" schedule proposed. Thierry Carrez posted the draft Hibiscus schedule — a 26-week cycle placing final release on September 30, 2026 — and asked for objections via the Gerrit review. The HTML rendering is available here. Separately, the TC's weekly meeting returned January 13 after a four-week holiday hiatus.

Development & Technical Decisions

RabbitMQ on EL is a live operator question. Francesco Di Nucci, upgrading from Caracal to Epoxy on EL with RDO packages, flagged that the CentOS Stream Messaging SIG still ships RabbitMQ 3.8 — which is EOL — and asked whether to move to 3.13 or the 4.x series. The thread (7 messages, 5 participants) was the week's most active. A concrete, unresolved pain point for RDO-based operators worth watching.

Operator troubleshooting filled the list. Karl-Heinz Preuß reported Cinder volume migration running ~100 MB/s when migrating from HPE Nimble to Ceph — far slower than either backend's real capability. The root cause appears to be that Cinder's migration path explicitly disables multipathing (multipath=false in the logs), and he asked whether this could be made configurable. An OVN BGP agent operator using nb_ovn_bgp_driver with underlay exposing hit NetlinkError: Network is down because OVS bridges appear down to ip link and the route-table setup fails here, with no reboot-persistent workaround surfaced yet. keshav bareja's OSA Epoxy Galera backup question continued — MariaDB 11.4.8 has retired the old mysqldump --all-databases workflow. A Nova resize bug with mismatched swap/no-swap flavor combos was filed as LP 2138418.

Neutron bug-deputy report (Jan 5–11). Rodolfo Alonso Hernandez reported one Critical (now-fixed: networking-bgpvpn and neutron-vpnaas unit tests failing due to tenant_id→project_id migration) plus one High (devstack on stable/2025.1 failing without wsgi, fix in 972669) and a few Medium items in progress.

Community & Events

This was a heavy week for strategy and direction. Jeremy Stanley opened "Taking OpenStack to the Next Level in 2026", sharing the Foundation staff's chosen goal — "Elevate OpenInfra projects to their next level" — translated for OpenStack into lowering barriers to participation, increasing reviewer bandwidth and efficiency, and simplifying the user survey. He framed this as better use of staff time rather than new work for maintainers, and asked for community feedback ahead of a board presentation.

Complementing that, Allison Price shared the 2026 marketing priorities: positioning OpenStack as the open-source infrastructure standard for AI workloads (the primary focus, with explicit interest in hardware-diversification efforts), digital sovereignty as a global growth driver, and VMware migration as continued momentum. Kendall Nelson separately kicked off a dedicated digital-sovereignty effort, with a first meeting January 20 at 07:00 UTC.

On metrics, Ildiko Vancsa continued working through Jay Faulkner's feedback on the new LFX Insights dashboards. Faulkner's core concern: the new dashboards feel "anemic" versus the old Bitergia/Stackalytics ones for individual reviewer stats, beyond-top-5 company comparisons, and per-project filtering. Vancsa walked through several existing controls and gathered use cases on an etherpad. This matters because Bitergia is being retired and several reviewer-evaluation workflows depend on it.

Routine scheduling rounded out the week: the Cinder Festival of Reviews ran Friday, January 16; the first 2026 Ops Radio Hour was set for January 23 at 13:00 UTC (agenda included 2026 plans and an Ops Radio Hour survey draft); the Public Cloud SIG met January 14; and Tacker cancelled its meeting for a Japanese holiday.