Stackers Network Digest — May 30, 2026

The Big Picture

Security dominated the week, with three OpenStack Security Advisories landing in a single 48-hour window — including a serious Keystone bundle covering five CVEs and a Neutron policy bypass affecting all 2026.x deployments. Outside of security, the Technical Committee pushed forward on Python PTI rework, the Ansible SIG got new chairs, and a long-running performance regression after Caracal→Epoxy upgrades was finally traced to python3-attrs. Operators picking up OpenStack-Ansible 2025.1 and kolla-ansible against external Ceph also generated a small wave of deployment questions on the list.

Security

Three OSSAs were published in quick succession by VMT liaison Goutham Pacha Ravi — operators should plan upgrades urgently.

• OSSA-2026-015 (Keystone, five CVEs) is the most serious of the week. Boris Bobrov (SAP) found that an authenticated attacker can inject RBAC policy targets via the JSON request body to bypass authorization on any policy-protected endpoint, read credential secrets, create credentials for arbitrary users, and escalate to cloud admin (CVE-2026-42999). Related issues allow application-credential impersonation within a shared project (CVE-2026-42998), trust-chained member→admin escalation that persists (CVE-2026-43000), cross-project EC2 credential creation (CVE-2026-43001, reported by Tim Shepherd), and indefinite federated-token rescoping (CVE-2026-44394, SAML2/OIDC only). Affected: Keystone >=14.0.0 <27.0.2, >=28.0.0 <28.0.2, >=29.0.0 <29.0.2. Patches are up for 2025.1/epoxy and 2025.2/flamingo — see the advisory.
• OSSA-2026-016 (Neutron tagging policy bypass, CVE pending) — a singular/plural mismatch between the tagging controller's action names and policy rules lets project readers create and update tags on same-project resources. Affects Neutron >=26.0.0 <26.0.4, >=27.0.0 <27.0.3, >=28.0.0 <28.0.1. Patches landed for epoxy, flamingo, gazpacho, and hibiscus (advisory, bug 2150132).
• OSSA-2026-014 (Swift s3api DoS, CVE-2026-49017) — Alistair Coles (NVIDIA) reported that a truncated aws-chunked PUT puts a proxy-server worker into an infinite loop until it becomes permanently unresponsive. Affects Swift >=2.36.0 <2.36.2 and >=2.37.0 <2.37.2 with s3api enabled (advisory).

Development & Technical Decisions

TC pushes PTI rework forward. The TC weekly summary (R-18 for 2026.2 "Hibiscus") confirms agreement to standardize dependency-group names in pyproject.toml and bindep profile conventions, mandate a minimal pyproject.toml for every project to nail down PEP 517 build isolation, and drop the nine-year-old Golang PTI doc entirely (fungi noted git history is sufficient if anyone ever wants to revive it). Project maintainers should track stephenfin's PTI rework patch series as it lands.

Ironic firmware interface consolidation. Doug Goldstein proposes deprecating the update_firmware step on the management interface, since the dedicated firmware interface now supersedes it in features and test coverage. Operators using the redfish-driven path should plan to migrate.

Cinder eyeing botocore.vendored removal. Amit Uniyal flagged that the S3 backup driver still imports from botocore.vendored, which AWS deprecated in 2019. CI uses moto and doesn't exercise the real path, so if you actually run S3 backups against modern botocore, speak up now before the driver switches to importing urllib3 directly.

os-brick rescan optimization for target-driven arrays. Erlon Cruz responded to Brian Bunker's (Pure Storage) proposal to avoid redundant rescans when the array drives rescans itself, asking for concrete performance numbers and agreeing connection_properties is the right place to expose the knob. A spec is expected.

ARM64 CI capacity is a bottleneck. Bartosz Bezak opened a discussion on insufficient AARCH64 CI capacity in OpenDev, pointing at Zuul launcher metrics. Currently OSUOSL is the sole donor; any organization with spare ARM64 hardware to contribute should chime in.

Agentic-workflows repo restart. Sean Mooney is reviving the conversation around the openstack/agentic-workflows repo created hastily before the PTG. Interested parties can sign up via the etherpad or join #openstack-agentic-workflows on OFTC.

Operator Notes

Nova performance regression on Epoxy traced to python3-attrs. Federica Fanzago reported that nova-api CPU usage climbed continuously after a Caracal→Epoxy upgrade on AlmaLinux 9. The fix: rebuild python3-attrs to 21.4.0 (the stock 20.3.0-7.el9 triggers the regression, even though bug 2121607 originally pointed at 21.2.0). After the rpm update, CPU went flat. Worth checking if you're on RHEL-family distros post-Epoxy.

Deployment Q&A. Frank (holywine@outlook.com) has been working through OpenStack-Ansible 2025.1 with OVN+DVR, reporting router_distributed = False in neutron.conf despite setting neutron_ovn_distributed_fip: True, and a provider-network reachability issue where VMs can reach the router but not the upstream gateway. Johannes Kastl is similarly working through kolla-ansible against external Ceph, with open questions on required Ceph users/pools and whether a separate ceph.client.nova.keyring is needed when reusing the cinder user. If you've solved these, replies would be welcome.

Neutron bug report (May 18-24). Rodolfo Alonso's weekly digest flags one CRITICAL (bgp_dragent failing to report state, bug 2153536, unassigned) and four HIGH issues including an ML2 mechanism unwind-order bug and a pbr-removal regression in version_info (already fixed).

Heads Up / Action Needed

• Patch Keystone, Neutron, and Swift now per OSSA-2026-014/015/016 — the Keystone bundle includes a path to cloud admin.
• Election officials wanted for the 2027.1 PTL/TC elections — reach out in #openstack-election on OFTC.
• Cinder S3 backup users: confirm whether you depend on botocore.vendored before the driver switches to direct urllib3 imports.
• ARM64 hardware donors: contact OpenDev infra if you can help expand AARCH64 CI capacity.

Community & Events

• Ansible SIG has new chairs: Michal Nasiadka (mnasiadka), Doug Goldstein (cardoe), and Dmitriy Rabotyagov (noonedeadpunk). Stephen Finucane is the new oslo release liaison. VirtualPDU was retired and devstack-plugin-lustre was added under QA and Manila.
• Ops Radio Hour was scheduled for May 29 at 1300 UTC, focused on the Operator's Contributor Guide — see the etherpad and the Ops Matrix room.
• We're now at R-18 to the 2026.2 "Hibiscus" coordinated release; M-1 is behind us and feature work is in full swing.