Stackers Network Digest — June 20, 2026

The Big Picture

Security dominated the week, with the OpenStack VMT publishing three Ironic advisories (including a new errata round for the kernel-command-line issue) and a notable Nova advisory about scheduler-hint injection that bypasses Placement. Beyond that, the community is in mid-cycle "Hibiscus" mode 15 weeks from release: PTG signups are open, Cinder and OSC are pruning legacy code, Heat operators are hitting Gazpacho upgrade pain, and there's a quietly important debate in openstack-helm about dropping built-in Ingress templates in favor of Gateway API.

Security

A heavy week of advisories — operators of Ironic and Nova in particular should patch promptly.

[OSSA-2026-022] Nova scheduler hint injection (CVE-2026-46448). Nova's server-create API does not strip internal scheduler hints, allowing authenticated users to bypass Placement resource claims and constraints like AZ, host aggregate, and image trait restrictions. Created instances end up with no Placement allocation, risking node resource exhaustion and — notably — cross-tenant data persistence on NVMe devices after deletion. Affects Nova ≥18.0.0 with fixed releases for epoxy, flamingo, gazpacho, and hibiscus. Patches: 993604, 993603, 993602, 993601. (advisory)
[OSSA-2026-023] Ironic unredacted sensitive properties (CVE-2026-54421). POST/PATCH to /v1/volume/targets could return iSCSI credentials and other sensitive properties unredacted to project-scoped users. Affects a wide range of Ironic versions from 17.0.0 onward; patches landed across antelope through hibiscus. (advisory, LP #2155049)
[OSSA-2026-017 Errata 1] Ironic kernel command-line script injection (CVE-2026-46447). The original patches for this iPXE script-injection issue rejected some valid (especially URL-encoded) kernel parameters. Operators must now apply both the original and errata-1 patches; as an interim workaround, CONF.conductor.disable_kernel_parameter_parsing can be set to false. (advisory)
[OSSN-0100] Ironic command injection in IPA. A new security note covers command injection in the Ironic Python Agent via chroot execution of tenant-controlled binaries. (note)
[OSSN-0097 Errata 1] Horizon RC file escaping (CVE-2026-55748). The previously published Horizon RC-file generation issue now has a CVE assigned. (note)

Separately, an operator on the list reported a likely cryptominer compromise (/.ccc.sh, qqq.service, an xmrig-style process connecting to 149.88.21.148). The thread reads as a generic post-exploitation infection rather than an OpenStack-specific bug, but it's a useful reminder to check exposed management endpoints and credentials. (thread)

Development & Technical Decisions

openstack-helm proposes dropping Ingress templates. Vladimir Kozhukalov is asking the community whether OpenStack-Helm should remove the legacy Ingress, service-ingress-*, and secret-ingress-tls templates, leaving charts to deploy only apps + ClusterIP Services. Exposure would move to .Values.extraObjects — typically a Gateway API HTTPRoute, which has been the CI default for ~4 months. Operators who lean on the built-in Ingress should weigh in now. (thread, review 993645)
OSC may drop Cinder v2 and Keystone v2.0 commands. Following the recent removal of nova-network support, Stephen Finucane is polling whether anyone still uses the block-storage v2 or identity v2.0 command sets in current openstackclient (not distro-shipped older versions). Keystone v2 was removed in Queens and Cinder v2 in Xena, so this is largely cleanup, but speak up if you depend on it. (thread)
Cinderlib retirement. With cinderlib's stable-branch commitment ending at the Bobcat EOL, Brian Rosmaita has posted project-config 993184 to retire the repo. The open question for unmaintained-branch maintainers is whether to delete unmaintained/{yoga,zed,2023.1} outright or invent a "mostly-dead" ACL that still lets the unmaintained-core team approve patches. (thread)
Zun broken on 2026.1. Dmitriy Rabotyagov flags that Zun and Zun UI are undeployable on 2026.1 with the current oslo_db constraints; the Zun core team is asked to review backports 988859 and 988868.
Heat upgrade pain to Gazpacho. Eugen Block reports two issues: a heat-manage db_sync failure resolved by converting the schema to utf8mb3/utf8mb3_general_ci, and a persistent [ec2authtoken] warning surfacing as IncompleteSignature AWS errors even on a cluster with no stacks. The latter is unresolved on-list and is worth attention from the Heat team given the 2026.1 release notes don't make the required config obvious. (thread)
Operator questions worth watching. Nathan Harper hit a nova-manage placement sync_aggregates mismatch with nova-compute-ironic ("91 compute node records for one host") when moving an ironic conductor between AZs; Kees Meijs is looking for guidance on Cinder-volume HA on Ceph; and Joel McLean opened a substantive discussion on phishing-resistant MFA (FIDO/passkey/WebAuthn) for both Horizon and the CLI, where the current ecosystem is largely limited to Vexxhost's keystoneauth-websso. (Nova/Ironic, Cinder HA, MFA)
OVN chassis flapping under memory pressure. Maximilian Stinsky-Damke describes OVN port-binding oscillating between source and destination hypervisors during long pre-copy live migrations of memory-stressed VMs on 2025.1, causing ovn-bgp-agent to flap BGP routes for VIP/FIPs. He's looking for confirmation of whether Nova is issuing multiple port-binding updates around the pre/post-copy transition. (thread)

Heads Up / Action Needed

October 2026 PTG team signups are open. The virtual PTG runs October 12–16, 2026. PTLs/SIG leads must submit the team survey by September 6 at 07:00 UTC. Registration is at ptg.openinfra.org. (announcement)
Hibiscus is 15 weeks out. TC chair Goutham Pacha Ravi noted the milestone in the TC agenda mail; the release schedule is the canonical reference.
Opensearch logs outage. The OpenDev Opensearch service (opensearch.logs.openstack.org) will be down for an upgrade on 23 June 2026 at 10:00 UTC.
Meeting cancellations. Manila skips its July 2 weekly meeting (June 25 still on); Octavia's next weekly meeting is cancelled.
Reviews wanted. Cinder ran a Festival of Reviews on June 19 (etherpad still useful for async); reviewers also requested on the Zun/Zun-UI 2026.1 backports above.

Community & Events

The OpenInfra Foundation is pointing projects at the LFX Mentorship platform as a year-round option (alongside the University Partnership Program) for running unpaid — or, with sponsor budget, paid — mentorship programs. Ildikó Váncsa is the contact for setup. (thread)
The Public Cloud SIG met on June 17 (wiki); operators interested in cross-cloud topics should keep an eye on its bi-weekly cadence.
Brian Haley posted the Neutron bug-deputy report for the week of June 8, the usual sign that triage cadence remains healthy heading into Hibiscus.