Stackers Network Digest — August 22, 2026

The Big Picture

With six weeks until the coordinated release of OpenStack 2026.2 "Hibiscus," the community hit a busy stretch: three security advisories (two with newly-assigned CVEs), a broken pbr release that quietly corrupted source tarballs across the ecosystem, PTL/TC nominations closing for the 2027.1 "Indri" cycle, and a leadership transition in Cinder. Development focus this week is on Milestone-3 preparation, with feature freeze, requirements freeze, and final client library releases all landing on August 24.

Releases & Announcements

Jeremy Stanley published the R-5 release countdown, and the TC's weekly summary confirms this week is the final release for non-client libraries, with Milestone-3 / feature freeze / requirements freeze / final client library release all on August 24. Project teams should be locking scope now.

The TC summary also flagged the wrap-up of the May–August Outreachy round: Esther Domfeh extended Ironic's node history API (mentored by Himanshu Roy and Riccardo Pittau) and Silvia Wachira migrated python-manilaclient functionality into OpenStackClient (mentored by Carlos Silva and Goutham Pacha Ravi).

Security

Three advisories landed in a single week — all reported by external researchers, with patches available for every supported branch:

• OSSA-2026-036 — Aodh + Watcher (CVE-2026-76878). Chen YuXiang (ICT, Chinese Academy of Sciences) found that Aodh does not enforce project scope on alarm listing when all_projects=false is supplied: any reader can enumerate alarms across projects, exposing webhook URLs and signal endpoints. Combined with a companion flaw in Watcher — its webhook trigger endpoint applies no authorization — any authenticated user can launch EVENT audits and action plans in another project. All Aodh and Watcher deployments are affected. Errata 1 attaches the MITRE-assigned CVE.
• OSSA-2026-035 — Octavia (CVE-2026-74248). Same reporter: by associating another project's QoS policy with an amphora, an authenticated user can block deletion of that policy. All Octavia deployments affected; patches available for epoxy, flamingo, gazpacho, and hibiscus.
• OSSA-2026-008 Errata 2 — Ironic (CVE-2026-42510). The original fix for the IPMI console command injection shell-quoted the command, but socat executes without a shell, breaking ipmitool-socat consoles entirely. New patches escape for socat's own address syntax. Only deployments with ipmitool-shellinabox or ipmitool-socat enabled are vulnerable.
• OSSN-0108 — Multiple authentication vulnerabilities in Ceph. Operators running Ceph-backed clouds should review the OSSN.

Development & Technical Decisions

Broken tarballs from yanked pbr 7.1.0. Pierre Riteau flagged that neutron-master.tar.gz and octavia-master.tar.gz at tarballs.opendev.org have been missing files (including neutron's alembic.ini) since August 13, breaking Kolla container builds. The culprit is the now-yanked pbr 7.1.0. Any project whose last merge landed during that window has a bad tarball; a workaround exists in a kolla patch, but the thread raises the question of whether the release team should force-refresh all affected tarballs.

Cinder Ceph gate broken by Ceph 20.2.4. Simon Dodsley reported Cinder's ceph jobs failing since ~15:00 UTC 2026-08-19 after Ceph published Tentacle 20.2.4 to the floating v20 tag. A recurring reminder that pinning matters.

Cinder encryption blocker. Markus Hentsch surfaced an 8-year-old image-encryption effort's latest snag: Cinder creates qcow2-with-LUKS encrypted volumes on RemoteFS backends (NFS), but os-brick only knows raw LUKS and silently reformats the file on first Nova attachment. See bug 2164526 and the WIP change 973870. Cross-team input from Cinder, os-brick, and Nova is being solicited before the feature can land.

Designate multi-tenant DNS gaps. An operator writeup catalogs five patches carried locally to run one Designate pool per tenant — worth reading if you have similar private DNS requirements.

Neutron bug deputy Bernard Cafarelli's weekly report highlights a High-severity fix (bug 2164648): iptables_hybrid firewall assigns a new conntrack zone on every OVS agent restart, breaking established connections. Master is fixed; backports are W+1.

Nova + H200 GPU passthrough. Christian Stelter confirmed NVIDIA H200 dual-GPU passthrough works on 2025.1 with the hw:maxphysaddr_mode=emulate / maxphysaddr_bits=46 flavor extras, q35 machine type, and UEFI firmware — useful data point for operators building AI inference infrastructure.

Heads Up / Action Needed

• Aug 24 — Milestone-3, feature freeze, requirements freeze, final client library releases for 2026.2 Hibiscus.
• Aug 19 23:45 UTC — PTL/TC nominations closed. TC campaigning period is now live; ask candidates hard questions before voting opens. Voter eligibility also required Foundation membership setup by that date.
• Patch now: OSSA-2026-035 (Octavia), OSSA-2026-036 (Aodh/Watcher), OSSA-2026-008 Errata 2 (Ironic socat consoles).
• Rebuild containers: if you consume master tarballs (Kolla, downstream image pipelines), verify neutron/octavia sources aren't missing files from the pbr 7.1.0 window.
• User Survey revisions: Slawek Kaplonski added Neutron team proposals to the User Survey etherpad; PTLs should review before finalization.
• Cinder Festival of Reviews happened Friday Aug 21 (1400–1600 UTC); recurring first/third Friday — ICS.

Community & Events

Cinder leadership transition. Jon Bernard announced he's stepping down as Cinder PTL after five cycles due to a work focus shift. Brian Rosmaita has filed candidacy for 2027.1 (Indri), returning to the role he last held in Yoga; his primary focus will be improving the security stance of cinder volume/backup drivers.

Barbican. Mauricio Harley is running for his third term as Barbican PTL, continuing the crypto-agility and post-quantum work — including the newly-approved PQC Migration pop-up team and #openstack-pqc IRC channel — plus SRBAC adoption.

Official candidate lists for PTL and TC 2027.1 are now posted; four TC seats are up.

Neutron drivers meeting was cancelled Aug 21 for lack of agenda; open neutron specs still need reviewers.