▤ Stackers Network

June 06, 2026

Stackers Network Digest — June 06, 2026

52 threads · 72 messages · openstack-announce, openstack-discuss

The Big Picture

This was a security-dominated week: the OpenStack Vulnerability Management Team published a wave of advisories covering Ironic (three CVEs plus OSSN-0099), Neutron, Mistral, Swift, Horizon, and oslo.messaging — most affecting all currently supported branches. In parallel, the 2026.2 "Hibiscus" cycle reached R‑16/R‑17 and the 2026.1 "Gazpacho" cycle‑trailing deadline landed on June 4, while operators upgrading from Epoxy to Gazpacho started hitting packaging and DB‑migration bumps. The community also opened the registration window for the October 2026 PTG and put out a maintainer SOS for three Neutron stadium dashboards.

Security

The VMT cleared a substantial backlog. Operators should plan an unscheduled patch round:

  • Ironic — three concurrent OSSAs and one OSSN. Dmitry Tantsur (Red Hat) and Tuomo Tanskanen (Ericsson) of the Metal3.io Security Team reported:
  • OSSA‑2026‑017 / CVE‑2026‑46447 – iPXE script injection via kernel command‑line override in node.driver_info/instance_info (advisory).
  • OSSA‑2026‑018 / CVE‑2026‑48681 – path traversal in ISO handling lets a crafted ISO overwrite files on the conductor or target disk (advisory).
  • OSSA‑2026‑019 / CVE‑2026‑44917 – file extraction from conductor via pxe_template; the feature will be removed in a future release (advisory).

  • OSSN‑0099 / CVE‑2026‑50589 – DoS in Ironic under reduced process stack size (note). Affected ranges span Ironic 17.x through 35.x; patches are available for Epoxy, Flamingo, Gazpacho, Hibiscus, plus courtesy backports to Antelope/Caracal and the 33/34 bugfix branches.

  • Mistral — critical RCE and token leak.

  • OSSA‑2026‑020 / CVE‑2026‑41283: missing policy enforcement on multiple API endpoints allows any authenticated user to create public resources and run arbitrary code on executor workers, with potential exfiltration of service credentials. Affects Mistral 20.0.0–22.0.0 (advisory).

  • OSSN‑0098: Mistral copies Keystone auth tokens (and service catalog) into workflow execution context, retrievable via YAQL/Jinja2. Fix is master‑only because backports would break workflows referencing $.openstack.auth_token; stable‑branch operators must rely on policy restrictions for now (note).

  • Neutron — RBAC bypass and tagging policy errata.

  • OSSA‑2026‑021 / CVE‑2026‑50266 (originally CVE‑pending, now assigned): a project manager can set device_owner to a trusted value like network:dhcp on a port in a shared network, bypassing anti‑spoofing and security groups. It's a regression of the 2015 OSSA‑2015‑018, reintroduced with manager role support. Affects 25.0.0 through 28.0.0 (advisory).

  • OSSA‑2026‑016 errata / CVE‑2026‑49299: a CVE was assigned to the previously reported tagging policy bypass allowing project readers to mutate tags.

  • Horizon — OSSN‑0097: shell metacharacters in project names are not escaped when generating RC files, allowing a domain manager to inject commands that run when a user sources the script. Workaround: use clouds.yaml instead (note).

  • oslo.messaging — OSSN‑0096 / CVE‑2026‑44393: the RabbitMQ TLS client validates the cert chain but not the broker hostname, enabling MITM on RPC/notifications. Fix lands in oslo.messaging 18.0.0 (Hibiscus) with hostname verification on by default; stable backports add an opt‑in ssl_enforce_hostname_verification flag (multi‑host configs need Kombu ≥ 5.2.0). Operators should audit broker certificate SANs before flipping the switch (note).

  • Swift — OSSA‑2026‑014 errata / CVE‑2026‑49017: scope updated to include Swift 2.35.1/2.35.2 (Epoxy) — the aws-chunked truncation DoS was backported there too.

  • Distro note. Thomas Goirand (zigo) reports Debian is now caught up on the recent Keystone, Cyborg, Neutron and Swift CVEs (Keystone backports go down to Victoria, plus Train), and is dropping pre‑Bullseye/Zed Ironic maintenance due to CVE volume (thread).

Releases & Upgrade Pain

Thierry Carrez sent the R‑16 release countdown for 2026.2 Hibiscus, and the Gazpacho cycle‑trailing release deadline was June 4 — primarily concerning deployment and config‑management projects, per the TC weekly (summary).

Eugen Block flagged two real‑world bumps moving from Epoxy → Gazpacho on Ubuntu 24.04/UCA: a dpkg overwrite conflict on /usr/bin/cinder-wsgi (and same for nova/placement/heat-dashboard), and a heat-manage db_sync failure creating the new resource_snapshot table due to a foreign‑key constraint mismatch (heat thread). Anyone upgrading should watch these threads before pulling the trigger.

Tempest master and the stable/2025.1 Ubuntu Jammy jobs are broken after an rpds-py constraint bump dropped Python 3.10 support; gmaan asked the community to hold rechecks while a fix lands (thread). Relatedly, grenade jobs testing the EOL stable/2024.2 → 2025.1 upgrade are being removed from integrated templates (review).

Heads Up / Action Needed

  • Maintainers wanted for three Neutron dashboards. Lajos Katona is putting networking-bgpvpn (bgpvpn_dashboard), neutron-vpnaas-dashboard, and neutron-fwaas-dashboard on deprecation watch. Horizon is moving openstack_dashboard.api off the deprecated python‑client libs to openstacksdk — without active maintainers these dashboards will simply break. Deadline: 2026.2 milestone‑3* before deprecation starts (call).
  • Cinder: driver-requirements.txt removal proposal. Brian Rosmaita wants to drop it in favor of pyproject.toml's project.optional-dependencies. Packagers and ops using the file should object on Gerrit 991215 now.
  • Cinder midcycle replaces the usual Festival of Reviews on Friday June 5, 14:00–16:00 UTC.
  • 2027.1 election cycle is starting. Slawek Kaplonski and Ian Y. Choi will run it again; the TC is looking for volunteers to shadow on #openstack-election on OFTC.

Development & Governance

The TC weekly notes continued progress on Stephen Finucane's PTI rework: release‑notes expectations merged, a deprecation warning on the unused Golang PTI merged, and review continues on dependency groups, bindep profiles, a pyproject.toml mandate, and the Python guide refresh. Release liaisons are being consolidated into the governance repo as the single source of truth — PTLs should keep projects.yaml entries current. Venus retirement is proceeding, with noonedeadpunk documenting ACL steps for orphaned teams.

On the driver front, Weka introduced its third‑party CI and a Manila driver; the Manila team welcomed it at the PTG (thread). Brian Bunker shared FC/iSCSI test results suggesting os‑brick performs redundant rescans on target‑driven‑rescan arrays, worth a look for storage driver maintainers.

Community & Events

  • October 2026 PTG dates announced: October 12–16, virtual, with registration open and free (announcement).
  • Ops Radio Hour recap (May 29) covered the Operators' Contributor Guide (volunteer found to refresh it), and war stories on moving/decommissioning datacenters. Next session June 26, 13:00 UTC (recap).
  • RDO RPM volunteers meet Tuesday June 9, 14:00 UTC to organize continued RPM builds for OpenStack (etherpad).
  • i18n SIG ran a Weblate Migration virtual sprint on June 3 jointly with the Infra team.
  • A run of newcomer questions from Johannes Kastl (domains vs. projects, default security‑group remote‑group rules, the four clouds.yaml entries in Kolla, TLS rotation, Git‑versioning Kolla configs) suggests a recurring documentation gap worth picking up — these are exactly the kinds of "obvious to old hands, opaque to newcomers" topics the Operators' Contributor Guide refresh could target.

This week in code · Week of 2026-06-06

Most active projects

See all active projects →