Stackers Network Digest — July 25, 2026

The Big Picture

This was a security-heavy week for OpenStack: the VMT published four advisories in three days — three affecting Ironic Python Agent and Zaqar (including a full auth bypass), plus a Neutron OSSN about cross-tenant sub-resource access. On the release side, the 2027.1 "Indri" schedule is out for review with a July 31 deadline, and the 2026.2 "Hibiscus" cycle is now at R-10 with elections nominations opening in two weeks. Ironic saw both scrutiny and reinforcement, gaining a new approver while patching three CVEs.

Security

Four advisories landed in rapid succession, all coordinated by Goutham Pacha Ravi. Operators should treat this as a required patching window.

• OSSA-2026-029 — Zaqar authentication bypass (CVE-2026-66139). Reported by Chen YuXiang (ICT, CAS). Sending an EXTRA-SPEC header causes Zaqar to skip Keystone authentication entirely — an unauthenticated attacker who knows a project UUID can read, enumerate, create, and delete that project's queues. All Zaqar deployments ≥12.0.0 are affected. Backports are up for epoxy, flamingo, gazpacho, and hibiscus; a follow-up proposes ripping out the EXTRA-SPEC feature altogether.
• OSSA-2026-027 — Ironic Python Agent root RCE (CVE-2026-66138). Reported by Dmitry Tantsur (Red Hat) and Tuomo Tanskanen (Ericsson) via the Metal3.io Security Team. The ntp_server config value is passed unsanitized into a shell command executed as root at IPA startup. In the common path, a Manager role tied to a node.owner project can trigger arbitrary root code execution. Affects IPA >=6.0.0 <10.2.3, >=11.0.0 <11.2.1, >=11.3.0 <11.5.1, and ==11.6.0. Patches cover all stable and bugfix branches (with 2023.1/2024.1 as courtesy backports; bugfix branches will get git patches but no new release). See LP #2160050.
• OSSA-2026-028 — IPA credential extraction via malicious container (CVE-2026-54422). Reported by Yuliang Xiao. In the bootc deploy interface, a malicious container can extract the OCI registry credentials used to fetch it. Any user allowed to deploy arbitrary containers via bootc can exploit this. Operators unable to patch immediately can disable the bootc deploy_interface on their conductors.
• OSSN-0102 — Neutron sub-resource authorization. Neutron's floating-IP port forwardings and router conntrack helpers authorize against the parent in the URL but load the child by bare UUID without verifying parentage. A project member who knows another tenant's sub-resource UUID can GET/PUT (and DELETE, for conntrack helpers) it. Affects neutron >=13.0.0 <26.0.4, >=27.0.0 <27.0.3, ==28.0.0. Mitigating factor: the UUID cannot be enumerated via the API. See LP #2150121.

Releases & Announcements

• 2027.1 "Indri" schedule proposed. Előd Illés posted the draft at Gerrit 996808 with the generated schedule preview. Comments needed by Friday, July 31.
• Ironic CWI deliverables still unreleased in Hibiscus. Illés flagged ironic-prometheus-exporter, ironic-python-agent-builder, ironic-ui, and networking-baremetal as cycle-with-intermediary deliverables with no 2026.2 release proposed yet.

Development & Technical Decisions

• Horizon/Keystone scope mismatch. Takashi Kajinami surfaced a conflict exposed by the removal of enforce_scope from oslo.policy (LP #2161292): with Horizon's default settings, Horizon sends domain-scoped tokens for most Keystone calls, but current Keystone policy rules don't expect that. Input wanted from both teams before this can be resolved.
• Nova/Neutron 502/504s on server list at Epoxy. An operator reports ~20% of openstack server list --all-projects --limit -1 calls failing with neutronclient MalformedResponseBody: Cannot understand JSON on a Kolla-Ansible Epoxy deploy (neutron 26.0.4.dev5, nova-api 31.3.1). Unresolved — anyone else seeing this on Epoxy should chime in.
• Neutron bug triage (Jul 13–19). Six bugs, three High severity — notably an OVN ovn-controller restart pinning distributed routers to a chassis (LP #2161232) and an OVN-Octavia issue creating LBs with --vip-port-id (LP #2160551), both with patches in review.

Community & Governance

• TC weekly summary (R-10). The 2027.1 election nomination window opens August 3 — four TC seats and several PTLs are up. The TC has reset DPL liaisons for Release Management, Requirements, Ironic, Freezer, and Oslo, inviting fresh nominations or PTL elections. About 20 project teams still need to nominate security liaisons in the governance repo — check your project's entry. The RISC-V SIG proposal merged, but CI plumbing is a real problem: OpenDev CI runs on an OpenStack cloud, so without Nova RISC-V hypervisor support there's no way to enroll donated RISC-V hardware. StackHPC has offered hosting via their Iceland cloud.
• Harald Jensas proposed as ironic-approver. Julia Kreger reports strong support; addition planned for Monday absent objections.
• Takashi Kajinami added to openstack-unmaintained-core. Illés confirmed the add for Heat unmaintained-branch work, and reminded that anyone willing to follow stable policy can opt in to help maintain unmaintained/* branches.
• Bence Romsics steps back from Neutron. After years of contributions, Bence has moved to a different project and asked to be removed from the Neutron deputy roster.

Events & Meetings

• Manila Hibiscus mid-cycle: July 27 (15:00–16:00 UTC) and July 30 (13:00–16:00 UTC). Topics on the etherpad; join via meetpad; recordings on the Manila YouTube channel.
• Meetings cancelled this week: Glance (PTL and most members away), Neutron CI (returns August 3), and Tacker (Japan public holiday).

Heads Up / Action Needed

• Patch now: Zaqar (CVE-2026-66139), Ironic Python Agent (CVE-2026-66138, CVE-2026-54422), Neutron (OSSN-0102). Zaqar's auth bypass and IPA's root RCE are the priorities.
• By July 31: Review the 2027.1 "Indri" release schedule.
• August 3: 2027.1 election nominations open — four TC seats and multiple PTL/DPL positions.
• Security liaisons: ~20 project teams still need to nominate one for the governance repo.
• Ironic release liaisons: propose Hibiscus release patches for the four CWI deliverables Illés flagged.