▤ Stackers Network

May 09, 2026

Stackers Network Digest — May 09, 2026

33 threads · 61 messages · openstack-announce, openstack-discuss

The Big Picture

This was a heavy security week: four fresh OpenStack Security Advisories landed in a single window, hitting Ironic, Cyborg, and Horizon. If you read nothing else, read the Security section and check your exposure. Beyond that, the week was shaped by the aftermath of the Hibiscus PTG — work-item docs, survey follow-ups, governance cleanup — plus a strong run of operator-focused architecture discussions on bare-metal networking, storage encryption overhead, and SRBAC deadlines. The 2026.2 "Hibiscus" cycle is at R-21/R-20, with milestone-1 approaching.

Security

OSSA-2026-009 / CVE-2026-43002 — Horizon unauthenticated session flood. A regression of CVE-2014-8124 in Horizon 25.6.0+. The login view writes a next=URL post-login redirect into server-side session storage before the user authenticates, so any unauthenticated request creates a persistent session entry. An attacker can fill Memcached/Redis/DB, evict admin sessions, and lock operators out. Affects Horizon >=25.6.0 <25.7.3 (2026.1 Gazpacho only — earlier release series are not vulnerable). Patch: Gerrit 986834. Credit Erichen (Institute of Computing Technology, Chinese Academy of Sciences); tracker bug 2150331.

OSSA-2026-010 / CVE-2026-42997 — Ironic credential forwarding via iDRAC configuration molds. A user able to invoke molds clean/deploy steps can specify an arbitrary remote URL; Ironic will send a Keystone token (full-privilege for everything Ironic itself is authorised to do) or basic auth credentials for molds storage to that URL. Affected ranges: >=17.0.0 <26.1.6, >=27.0.0 <29.0.5, >=30.0.0 <32.0.1, >=33.0.0 <35.0.1. Patches across Antelope, Caracal, Dalmatian, Epoxy, Flamingo, and Gazpacho. The molds feature was deprecated in 2024.1 Caracal and has been removed during 2026.2 Hibiscus development; if you weren't using it, plan to stop. Credit Dmitry Tantsur and Tuomo Tanskanen (Metal3.io Security Team); tracker bug 2148317.

OSSA-2026-011 / CVE-2026-40213, CVE-2026-40214 — Cyborg multiple access-control vulnerabilities. Sean Mooney (Red Hat) reported two related issues. Default policy rules on device, deployable, and attribute endpoints use an unconditional allow check — any authenticated user gets full access regardless of role or project (CVE-2026-40213). Separately, ARQ (Accelerator Request) resources have no project-ownership enforcement, so any authenticated user can enumerate, delete, or manipulate ARQs belonging to other projects (CVE-2026-40214). All Cyborg deployments are affected. Affected: >=3.0.0 <14.0.1, >=15.0.0 <15.0.1, >=16.0.0 <16.0.1. Patches span 2025.1 Epoxy (start), 2025.2 Flamingo (start), and 2026.1 Gazpacho (start).

Looking forward. Michael Still picked up the long-running qemu-img threat-model discussion and went radical: he prototyped Instar, a from-scratch image-handling VMM that runs untrusted image parsing inside a custom KVM guest with no OS, no filesystem, no network — only the VMM-orchestrated resources required. Mostly written by Claude Code. Worth reading for the threat-model framing alone: shakenfist.com/components/instar/technology-primer, quirks, output-formats, code.

Security working practices. Sylvain Bauza did the unglamorous work of pruning inactive members from project core-security teams, starting with nova-coresec — a reminder for every PTL to audit their own.

Development & Technical Decisions

SRBAC enforce_scope removal is for real. Ghanshyam Maan tagged the five projects still disabling it — Cinder, Tacker, Aetos, Aodh, Barbican — and pushed test changes to each: cinder, tacker, aetos, aodh, barbican. Target removal: milestone-2, 3 July 2026. Related: Franciszek Przewoźny's global auditor/reader thread continued, with openstack-exporter issue 552 noted as already able to consume system-scoped roles.

Bare-metal networking at scale. Doug Goldstein posted a substantial design discussion on driving bare-metal at scale with Neutron and Ironic. Neutron's VXLAN model assumes a uniform underlay, which breaks in spine-leaf bare-metal environments where you are the underlay. He points to the Neutron EVPN VXLAN docs spec 965415, the networking-baremetal L2VNI mechanism driver, and his own multi-fabric VXLAN draft (gist) as starting points for the disjoint-VNI-pool problem.

pbr at runtime? Doug Goldstein also opened a question on dropping pbr as a runtime dependency — keep it for build, drop it for runtime in favour of importlib.metadata. Jeremy Stanley and Clark Boylan noted that pbr.json still carries git-commit metadata importlib doesn't, so there's a real tradeoff. (TC IRC log from 28 April.)

Cinder encryption performance. A controlled benchmark in this thread found that QEMU-layer LUKS imposes a real 23–43% throughput hit at 1M block sizes versus near-zero overhead on the librbd LUKS path — because QEMU decrypts serially on one thread, while librbd parallelises per object. Reviews 986322 / 986323 are linked.

Os-brick / Pure Storage. Brian (Pure Storage) floated a target-driven-rescan proposal for os-brick: when the array itself reports LUN add/remove events, skip redundant initiator rescans. Looking for community appetite before writing a spec.

Ansible SIG revival. Michał Nasiadka proposed to co-chair the Ansible SIG alongside Dmitriy Rabotyagov (OSA PTL) and Doug Goldstein. The SIG wiki still references defunct Freenode IRC; ansible-collections-openstack is a critical dependency for both Kolla-Ansible and OSA and was drifting.

Nova AARCH64 SMBIOS. Tam Nguyen (Ampere) reported that the libvirt driver only exports the "OpenStack" SMBIOS string for x86, which breaks cloud-init on ARM guests. Patch coming.

Octavia + OVN. Eduardo Morais asked about Horizon support for the Octavia OVN driver; two long-running dashboard patches are linked (983047, 775561).

Other operator threads. Eugen Block's Kolla-Ansible multinode deployment silently skipped core services (9-message thread). Joel McLean reported RBD-locked disk corruption during nova-evacuate / Masakari failover without STONITH. Jay See's DHCP MessagingTimeout on 2026.1 split neutron-rpc-server remains open (logs) — pre-cursor to the Lajos Katona follow-up later in the month. Radomir Dopieralski broke all Horizon plugins again: update your babel-django.cfg/babel-djangojs.cfg after the pkg_resources deprecation killed enmerkar.

Heads Up / Action Needed

  • Patch immediately: Horizon 2026.1, Ironic (molds), Cyborg (all deployments).
  • SRBAC: Cinder, Tacker, Aetos, Aodh, Barbican — get scope-enforcement-clean by milestone-2 (3 July).
  • Ironic 2026.2 work items are published; summary video on the GR-OSS YouTube channel.
  • build-openstack-releasenotes job is moving to tox (review 966618) — ensure your repo has a working releasenotes tox testenv.
  • User Survey volunteers wanted: Allison Price is collecting input through mid-July for the August 2026 OpenStack User Survey refresh (etherpad, current survey).

Community & Events

The TC weekly summary notes Hibiscus TC PTG recordings are on YouTube and bulk Launchpad team-ownership cleanup is progressing. Tacker cancelled its IRC meeting for a Japan holiday. The Public Cloud SIG met 6 May (meetpad). PyCon and Open Source Summit North America are coming up on the calendar.