▤ Stackers Network

September 05, 2026

Stackers Network Digest — September 05, 2026

28 threads · 47 messages · openstack-announce, openstack-discuss

The Big Picture

With four weeks to go until the 2026.2 "Hibiscus" coordinated release, the community is deep into RC territory: feature-freeze exceptions are piling up in Neutron and OSC, PTLs are being asked to file cycle highlights, and the TC is finalizing PTL appointments while its own election runs. The dominant news of the week, though, is a Glance security advisory covering three SSRF vulnerabilities that operators should patch immediately.

Security

OSSA-2026-038 — Multiple SSRF vulnerabilities in Glance (CVE-2026-71196/71197/71198) is the headline item. Glance's web-download import method ships with insecure default filtering that lets authenticated users fetch arbitrary internal URLs (including cloud metadata endpoints), and its URI validator does not perform DNS resolution before host filtering — enabling bypass via attacker-controlled domains and DNS rebinding. Separately, the HTTP image location API lacks host filtering entirely when the HTTP store is enabled, and since fetched content is stored as image data, blind SSRF becomes full-read exfiltration. Affected ranges are Glance ≥16.0.0 up to (but not including) 30.2.1, 31.1.1, and 32.0.1. Backports have landed for Epoxy, Flamingo, Gazpacho, and the Hibiscus development branch — see the advisory thread for the full patch list. Any deployment using web-download or HTTP image locations should patch now.

Releases & Announcements

Elõd Illés kicked off the R-3 release countdown for Sep 7–11. In parallel, Jeremy Stanley is calling on PTLs to push cycle highlights for Hibiscus into openstack/releases this week — the OpenInfra marketing team is preparing press materials and is particularly interested in AI, digital sovereignty, security, and VMware feature-parity items. Highlights land at releases.openstack.org/hibiscus/highlights.html.

Development & Technical Decisions

Feature Freeze Exceptions. Post-feature-freeze, a wave of FFE requests hit the list:

RBAC discussion. Doug Goldstein opened a broad conversation on system scope as resource scope vs. privilege level, floating the idea that unscoped tokens handle authentication while scoping handles authorization. This is explicitly an early-stage discussion aimed at rethinking OpenStack personas — not a proposal.

tooz assert regression. Rafael Weingärtner flagged an unexpected assert in coordination.py (introduced by commit bf925b9) that broke CloudKitty CI mocks of the coordination driver. Downstream projects mocking tooz will likely need to adjust; the discussion is ongoing about whether the check belongs there at all.

Manila IPv6 CI regression. Simon Dodsley reported that manila-tempest-plugin-lvm has failed consistently since ~21:00 UTC on 31 Aug on the six NFS IPv6 scenario tests, with paramiko auth failures over ULA. IPv4 equivalents pass. Correlated with five newly un-skipped microversion 2.96 migration tests adding ~25 minutes of concurrent load on a 256 MB guest. More eyes wanted.

Operator ask. Nguyễn Hữu Khôi asked how to limit resource usage per Availability Zone with Nova moving toward Keystone Unified Limits — an open question worth watching for anyone running multi-AZ deployments.

Swift + S3 gotcha. Andrei Corduneanu documented an undocumented fix for SignatureDoesNotMatch: newer Keystone requires service-auth credentials in [filter:s3token], and authtoken must appear before s3api/s3token in the proxy pipeline. A docs contribution would help others.

Governance & Community

TC weekly update. Goutham Pacha Ravi's R-4 TC summary reports that PTL elections for 2027.1 "Indri" are complete, with Glance, Masakari, and Skyline coming through as "leaderless" but each having willing candidates that the TC is deliberating appointing. The TC election itself is in polling through September 16 — five candidates for four seats. Individual OIF members who are active OpenStack contributors should have received a CIVS ballot; if not, opt-in on CIVS. Notably, fungi's tooling update treating core reviewers as Active Contributors added ~4% (10 cores) to the electorate who otherwise wouldn't have qualified.

Core team refreshes. Stephen Finucane posted Nova/Placement core-team updates removing inactive members, and proposed adding Doug Goldstein (cardoe) to sdk-core (lazy consensus, changes 14 Sept). Goutham Pacha Ravi is refreshing the stale service-types-authority core group via lazy consensus — speak up if you want to help maintain it.

Contributor experience. Ildikó Váncsa published recommendations from the Gazpacho 'Bridging the Gap' work, covering review templates, dashboards, a two-stage core-approval process being trialed by several teams, and the OpenInfra AI policy. She also opened the Hibiscus contributor/maintainer surveys — deadline October 18.

Heads Up / Action Needed

  • Patch Glance for OSSA-2026-038 SSRF vulnerabilities.
  • Vote in the TC election by September 16.
  • Push your Hibiscus cycle highlights this week.
  • Fill in the contributor/maintainer surveys by October 18.
  • PTLs/Cores: review outstanding FFEs (Neutron ×3, OSC ×1) before RC-1.
  • Cinder's Festival of Reviews ran Sep 4; the next occurrence follows the first/third-Friday cadence.
  • Ironic's weekly meeting on Sep 7 is cancelled (regional holiday); resumes Sep 14. Neutron Drivers meeting for Sep 4 was also cancelled.

This week in code · Week of 2026-09-05

Most active projects

See all active projects →