Stackers Network Digest — August 15, 2026

The Big Picture

This was a security-heavy week for OpenStack, with two OSSAs and three OSSNs landing in short succession across Octavia, Designate, Ironic, and Glance — operators of any of those services have real work to do. In parallel, the 2026.2 "Hibiscus" cycle is entering its final stretch: feature freeze is two weeks away, the 2027.1 TC/PTL nomination window is open, and PTG signups are closing. Operator threads clustered around a familiar theme — Kolla Ansible upgrades, distro transitions, and hardware realities catching up to hypervisor code paths.

Security

Five advisories/notes hit the announce list in five days. Operators should prioritize triage now:

• [OSSA-2026-034] Designate — Cross-tenant DNS zone overlap and mDNS DoS via pool scheduling (CVE-2026-71193, CVE-2026-71194). Affects Designate >=1.0.0 <20.0.2, 21.0.0, 22.0.0. Any deployment using multiple Designate pools is exposed: a tenant can create sub-, super-, or duplicate zones of another tenant's by targeting a different pool, enabling DNS hijack or DoS via the pool-blind mDNS handler. Patches are available for epoxy, flamingo, gazpacho and master. Note that the stable backports depend on prerequisite mDNS split-horizon patches (998005/998006), and operators are advised to audit existing zones for cross-tenant collisions that predate the fix. Advisory · LP 2160533
• [OSSA-2026-035] Octavia — Unauthorized QoS policy deletion lock (CVE pending). Affects Octavia <16.0.2, 17.0.0, 18.0.0; all deployments impacted. An authenticated user can associate another project's QoS policy with an amphora to block its deletion. Patches for epoxy/flamingo/gazpacho/hibiscus are up. Advisory · LP 2161500
• [OSSN-0105] Glance — Legacy Tasks import bypasses image import URI filtering. Operators still exposing the legacy Tasks API should review their configuration. Notice
• [OSSN-0106] Ironic — API ramdisk endpoints require network-level access controls; the ramdisk endpoints are not safe to expose on tenant-reachable networks. Notice
• [OSSN-0107] Ironic-Python-Agent — Container HardwareManager security model misimplemented. Operators using IPA container HardwareManagers should read the notice and reassess their trust boundaries. Notice

Releases & Development

Thierry Carrez posted the R-6 release countdown for the 2026.2 "Hibiscus" cycle, keeping projects aimed at the milestone-3/feature freeze at R-5 (August 27). Goutham Pacha Ravi's TC weekly summary reiterates that most teams should be in feature-landing mode this week and next. (TC summary)

On Neutron, bug deputy Miro Tomaska filed the week's report with seven new bugs — notably an IPAM/ipallocations sync issue causing FIP failures (LP 2163236), an OVN DB cleanup gap when disabling the Port Forwarding plugin (LP 2163184), and a ProcessManager pid-file bug on reload (LP 2163415). Brian Haley cancelled Friday's Drivers meeting for lack of agenda; the open specs queue is the place to shape drivers' next agenda.

Bhavna Sorte proposed a Keystone federation pattern for VDI/session brokers using Kasm as a reference implementation (broker-agnostic — Guacamole, Leostream also fit). Keystone contributors and the SIG are invited to weigh in on whether this warrants a spec or a docs pattern.

Operator Corner

Several long operator threads made the "why does this fail?" case for various stacks:

• H200 PCI passthrough hits the QEMU MMIO hole. Christian Stelter reports that NVIDIA H200 passthrough fails on 2024.1/Kolla because hw:maxphysaddr_mode=passthrough requires libvirt ≥8.7.0/QEMU ≥2.7.0 (the shipped libvirt is 8.0.0), and no supported knob exists to set opt/ovmf/X-PciMmio64Mb. See the maxphysaddr spec and the open LP 2160972 for the ongoing feature request. A useful signal for anyone deploying H200 on older stable branches.
• Kolla-Ansible 2024.1 → 2025.1 upgrade produced intermittent failures for Eugen Block (hypervisor list 503s, OVN NB DB target-list gaps, RabbitMQ running out of file descriptors). He resolved it by raising Docker daemon ulimits and upgrading with --limit control before touching computes — worth bookmarking.
• Kolla-Ansible on mixed Rocky 9/10. Gian-Andrea Conzett flags that ansible_python_interpreter is not honored on delegated tasks (fact gathering, nova-compute registration wait), blocking a Rocky 9→10 stepping-stone before the 2025.1→2026.1 upgrade. No resolution yet.
• OSProfiler + Jaeger + eventlet is broken. Thamanna Farhath documents that jaeger-client's TUDPTransport uses getaddrinfo(type=...), which eventlet's monkey-patched version doesn't accept (socktype expected). Keystone works under mod_wsgi; Nova/Neutron do not. jaeger-client-python is archived, so an upstream fix is unlikely — anyone with a working recipe is asked to share.
• VPNaaS + OVN — Niklas Schwarz reports site connections stuck in PENDING_CREATE on both DevStack Caracal and Epoxy following the Xena OVN VPNaaS spec. Open question whether this combination is still recommended.

Heads Up / Action Needed

• 2027.1 TC & PTL nominations close August 19. Four TC seats are up; Sylvain Bauza and Tony Breeds are not seeking re-election. To vote, ensure your Gerrit email is on your OpenInfra Foundation membership profile before the deadline. The TC also adopted a resolution treating +2/workflow reviewers as Active Contributors, altering the electorate and PTL eligibility.
• Extra-AC nominations — PTLs and DPL liaisons: this is the extra-AC freeze week; recognize your bug triagers, doc writers, and meeting drivers via a governance change so they can vote and receive release credit.
• Feature freeze / Milestone-3 for 2026.2 "Hibiscus" is on August 27 (R-5).
• October 2026 PTG signup — teams must complete the survey by September 6, 07:00 UTC. Event runs October 12–16, 2026, online; free registration here.
• University Partnership Program mentors/projects — Kendall Nelson is collecting proposals for BU and NDSU capstone programs by September 1 on this etherpad.
• Everything Open Brisbane 2027 CfS — session proposals due September 6, 2026 (AoE); OpenInfra-adjacent tracks are explicitly welcomed. Details.

Community & Events

The Public Cloud SIG held its bi-weekly meeting on August 12 (info). The TC summary also flagged upcoming community events including the OpenStack Nigeria user group and a KCD × Ceph × OpenInfra Day Korea, both linked from the weekly TC digest.