Stackers Network Digest — July 11, 2026

The Big Picture

Security dominated the week, with three separate advisories landing across Ironic and Nova — two of them carrying CVEs and affecting stable branches all the way back to Caracal. Alongside the CVE work, Julia Kreger opened a broader conversation about the state of OpenStack's security documentation, while the TC pushed forward on governance housekeeping (cursive moving under Oslo) and reminded the community that PTL/TC election nomination season is only weeks away. On the release side, the 2027.1 cycle got a name — Indri — and Hibiscus development crossed the M-2 milestone with 12 weeks to go.

Releases & Announcements

• 2027.1 named "Indri". Allison Price announced that the community vote picked Indri as the name for the 2027.1 OpenStack release (thread).
• Hibiscus (2026.2) is 12 weeks out. The TC weekly summary notes the project has cleared the Hibiscus-2 milestone, with 2026.2 coordinated release scheduled for later this year (thread).

Security

Three advisories landed in a single week — operators of Ironic and Nova should plan patching now.

• OSSA-2026-025 — Ironic: RBAC bypass via IPMI send_raw (CVE-2026-54423). Discovered by Dmitry Tantsur (Red Hat) and Tuomo Tanskanen (Ericsson) of the Metal3.io Security Team. A user able to initiate manual cleaning/servicing (or with access to VendorPassthru) can send arbitrary IPMI raw commands to a node's BMC. The fix applies a blocklist for send_raw in certain provisioning paths; operators who legitimately use send_raw should carefully review the patches for behavior changes. Affects Ironic >=22.1.0 <29.0.6, >=30.0.0 <32.0.2, >=33.0.0 <35.0.2, >=36.0.0 <37.0.1. Patches span Epoxy through Hibiscus and Bugfix branches (advisory).
• OSSA-2026-026 — Ironic: Insufficient access controls on parent/child nodes (CVE-2026-44918). Same reporters. A project manager can reparent Volume Connectors/Targets across projects (potentially leaking iSCSI boot-from-volume secrets, bug 2150256) or attach a foreign node as a child to influence the parent — e.g., forcing power-on (bug 2150450). The fix now requires matching node.owner between parent and child, and adds an ironic-status upgrade check to detect drift. Operators concerned about prior exposure are urged to audit expected volume connector/target counts. Backports cover Caracal (unmaintained) through Hibiscus (advisory).
• OSSN-0101 — Nova console WebSocket proxy Origin allow-list poisoning. Goutham Pacha Ravi published a security note (no CVE assigned) covering a bug where the console proxy appends the incoming Host header to the process-shared oslo.config allowed_origins list on every request. Because oslo.config caches the list, any Host value ever seen is permanently trusted — an unauthenticated attacker can poison the allow-list and defeat the Origin check, and drive unbounded memory growth. Affects Nova >=12.0.0 <31.3.2, >=32.0.0 <32.2.2, >=33.0.0 <33.0.3. Fixes are in review across Epoxy, Flamingo, Gazpacho and Hibiscus (e.g. master). Credit: Sergey "r0binak" Kanibor, Luntry (advisory).
• Zooming out on security. Julia Kreger opened a thread titled "OpenStack Security Documentation crisis; prioritizing security work" (thread). The message body wasn't captured, but the framing — "crisis" — is a strong signal that the security SIG is looking to reset priorities. Worth watching.

Development & Technical Decisions

• Cursive moving under Oslo. After sitting idle for ~5 years, the plan to move the cursive signature-validation library (a dep of Nova, Glance, Cinder) from x/ into openstack/ under Oslo governance is finally being executed. Patches are up for TC vote (governance, project-config, releases); the OpenDev repo move was scheduled for July 9, 21:00 UTC (thread).
• Removing the enforce_scope config option. As part of the Secure/Default RBAC community goal, Ghanshyam Maan is dropping the enforce_scope config option and has flagged fallout in multiple services (thread). Project teams should expect follow-up patches.
• Heat opting into unmaintained-branch maintenance. Takashi Kajinami proposes that heat-stable-maint take over Heat's unmaintained branches — a reversal of the earlier decision made when interest in the project was low. Rising activity, plus more AI-discovered security bugs landing on old branches, is the driver (thread).
• Horizon top-bar redesign — feedback wanted. Radomir Dopieralski is consolidating the top-nav dropdowns into one right-aligned group (closer to OpenShift Console's layout). Because it's high-visibility, he's explicitly soliciting feedback before merging (bug 2160046, patch 996310).
• Cinder / NVMe-FC. Anthony Galica asked whether Cinder actually supports NVMe-FC — noting zero drivers implement it and inconsistent LLM-generated answers (thread). No authoritative response yet on-list; anyone with driver-side knowledge should chime in.
• Neutron bug deputy report (week 27). Lajos Katona summarized one critical FWaaS bug plus several highs including OVN RPC-worker log spam and a regression in OVN router gateway port failover (bug 2158987). A wishlist item to support Apache mod_wsgi for the Neutron API is also picking up patches (bug 2158981).

Heads Up / Action Needed

• Patch Ironic and Nova now for OSSA-2026-025, OSSA-2026-026, and OSSN-0101 (see Security section for affected version ranges).
• TC / PTL election nominations open August 3, with an Extra-AC freeze the week of August 10. Four TC seats are up. PTLs: recognize your invisible contributors (triagers, organizers) by proposing them as Extra-AC in the governance repo (TC summary).
• Manila Hibiscus bugsquash: July 13–17, kickoff review sign-ups Monday, IRC sync Tuesday 14:00 UTC in #openstack-manila (etherpad).
• Cinder Festival of Reviews: Friday July 10, 14:00–16:00 UTC (etherpad).
• Neutron meetings cancelled the week of July 13 (CI, weekly, drivers) due to PTO/travel; they resume the following week (thread).
• Horizon nav change — try the patch and give Radomir feedback before it merges.

Community & Operators

• TC weekly. Beyond the items above, the TC is progressing the Contributor Experience Working Group proposal and discussing extending project-retirement cleanup to also archive PyPI packages and close Launchpad trackers so retired projects stop confusing users (summary).
• Kolla-Ansible MFA gotcha. Joel McLean walked through a common misconfiguration where application credentials fail because the user's multi-factor-auth-rule only lists password. The fix is per-user rule assignment (e.g. password,ip_filter or password,totp) plus enabling the corresponding auth methods in keystone.conf — a useful reference for anyone rolling out MFA on Kolla deployments (thread).
• Operator questions. Thomas Goirand asked about Secure Boot for aarch64 KVM guests on Ampere Max under 2025.2 Nova (thread); and KK CHN posted a detailed greenfield-design question for a small NGO R&D data centre (100–150 VMs, Ceph, GPU passthrough, geo-replication) looking for community advice on whether to bet on OpenStack over Nutanix/vVF (thread). Both are open for on-list help.