Stackers Network Digest — August 08, 2026

The Big Picture

Security dominated the week: the VMT published a fresh Ironic advisory plus errata (with new CVE identifiers) for four previously-issued Swift and Keystone advisories, and two new OSSNs landed for Manila and Ironic-Python-Agent. In parallel, the community entered election season — nominations for the combined PTL/TC 2027.1 "Indri" vote opened August 5 — and the 2026.2 "Hibiscus" release moved into the R-7 countdown. A longer-running conversation about how OpenStack talks about its own threat model also gathered steam.

Security

This was an unusually heavy security week. Operators should audit their inventory against the following:

• OSSA-2026-033 — Ironic Portgroup shard filter bypass (CVE-2026-71201). A project reader listing portgroups by shard sees portgroups outside its project. Affects Ironic >=34.0.0 <35.0.2 and >=36.0.0 <38.0.1. This is the portgroup analogue of OSSA-2026-026 (which was for ports). Patches are up for 2026.1/gazpacho and hibiscus; bugfix-branch patches will land in git but no bugfix release is planned (bug 2162715).
• OSSA-2026-030 errata — Swift S3API authorization bypass (CVE-2026-71191, CVE-2026-71192). Two flaws in S3API header validation let an attacker copy/read cross-tenant objects — one in the default s3_acl=false path, the other with s3_acl=true. Affects Swift >=2.18.0 through the fixed releases.
• OSSA-2026-031 errata — Swift Accept-header ReDoS (CVE-2026-71190). Unauthenticated attackers can exhaust Swift proxy workers via crafted Accept headers.
• OSSA-2026-007 errata — Keystone LDAP enabled misinterpretation (CVE-2026-40683). LDAP-disabled users could still authenticate when user_enabled_invert=False (the default). Workaround: set user_enabled_invert=True with an inverted attribute (e.g. nsAccountLock) or use user_enabled_emulation. Fixed in gazpacho (29.0.0) and backported to dalmatian/epoxy/flamingo.
• OSSN-0104 — IPA mDNS fallback. Ironic-Python-Agent (>=3.7.0 <11.6.2) could, in rare cases, reconfigure itself via mDNS and be directed at a different Ironic API. The development branch now requires explicit opt-in (ipa-api-url=mdns or ipa-use-mdns=True). Heads up: these fixes are backwards-incompatible and will not be backported, so operators using mDNS fallback with virtual-media images must explicitly enable it before upgrading to 2026.2.
• OSSN-0103 — Manila cross-project resource-lock read. Any authenticated reader who knows another project's UUID can list its resource-lock (and access-rule lock) metadata. Fixed across Manila <20.0.2, <21.0.2, <22.0.1 and hibiscus.

Reporter credits notable this week include Christian Schwede (NVIDIA) for the Swift trio and Chen YuXiang (ICT, CAS) for both the Ironic portgroup and Manila resource-lock issues.

Development & Technical Decisions

Rethinking the security narrative. Goutham Pacha Ravi (TC/VMT) revived the threat-model discussion started by Julia Kreger and JayF, arguing that the aging Security Guide should be broken up into per-project threat models maintained by the code owners, with the guide reduced to routing documentation. The TC has begun formally requiring security liaisons and sees that group as the vehicle for this work, potentially as a community goal with a "security maturity scorecard." Operator and researcher input is explicitly wanted.

Horizon/Keystone scope mismatch. Takashi Kajinami has proposed option 2 — using project scope in Horizon — noting that since all services keep project-admin as effectively a system admin even under SRBAC, project scope is the pragmatic choice until scope separation is redesigned.

TC weekly update. The R-8 summary flags a governance charter change to count Gerrit reviewers (CR+2/-2, W+1) as Active Contributors for election purposes — the TC is aiming to merge it before voting opens August 26. Also of note: Manila is switching to a ~16 MB test image (from 450 MB), cutting CI runs from ~2 hours; and fungi traced a lingering GitHub redirect breakage back to January's Zuul key rotation.

Cinder/Nova NVMe-TCP multipath. In a devstack thread, Takashi Kajinami reminded contributors that [libvirt] volume_use_multipath must be set in nova-cpu.conf, not the base nova.conf, since n-cpu reads a separate config.

Gerrit review tooling. Erlon Cruz shared two Tampermonkey scripts: one that hides CI/Zuul comments to declutter human discussion, and an experimental change-summarizer that calls OpenAI/Anthropic APIs to summarize long review threads. Useful for anyone who deals with Cinder's third-party CI noise.

Heads Up / Action Needed

• PTL/TC nominations open — deadline Aug 21. Elections officials Slawomir Kaplonski et al. announced the combined 2027.1 "Indri" PTL and TC election. Nominations opened Aug 5 23:45 UTC; voting opens Aug 26. Confirm your electorate email and renew your OpenInfra Foundation membership or your ballot won't be sent.
• R-7 countdown (Aug 10-14). The release team's countdown puts Hibiscus eight weeks from release. The 2027.1 "Indri" schedule is out and features a four-week gap between M-2 and M-3 and a non-client library final release at R-6 — shorter than in prior cycles.
• Neutron User Survey feedback — reply by Aug 21. Slawek Kaplonski has drafted proposed Neutron changes to the 2026 User Survey; the overall submission deadline is Aug 24.
• Ironic Node History feedback wanted. Outreachy intern Esther Domfeh is collecting operator use cases for extended Node History (state transitions, durations, user/project context, power telemetry).
• Cinder Festival of Reviews was held Aug 7; the recurring session runs first and third Fridays 1400-1600 UTC (etherpad).
• Tacker weekly IRC meeting is cancelled Aug 10, back Aug 17.

Community & People

Sylvain Bauza is stepping down from the TC after two terms, freeing a seat just as nominations open. Thanks, Sylvain — and a nudge to anyone who's considered running: this is the moment.

The CFP for OpenInfra Days North America is open (linked from the TC weekly), and the TC is also seeking program-committee volunteers.