Stackers Network Digest — August 01, 2026

The Big Picture

Security dominated the week: the OpenStack Vulnerability Management Team published four advisories in as many days, covering two Swift authorization bypasses, a Swift proxy DoS, and a Neutron subnetpool cross-project mutation. Alongside the CVE churn, Julia Kreger opened a broader conversation about whether OpenStack's threat model still matches how operators actually run clouds. Elsewhere, the 2026.2 "Hibiscus" release entered its final nine weeks while the TC prepared the ground for the "Indri" (2027.1) election cycle.

Security

Four Swift and Neutron advisories landed this week; operators should plan patching now.

• OSSA-2026-030 — Swift S3API header authorization bypass. Two distinct vulnerabilities reported by Christian Schwede (NVIDIA) allow an attacker who knows target container/object names to copy and read cross-tenant objects. One affects the default s3_acl=false; the second affects s3_acl=true. Any deployment using the S3API middleware between 2.18.0 and the fixes should update. See LP #2158733.
• OSSA-2026-031 — Swift proxy DoS via Accept header. Also from Schwede: catastrophic regex backtracking in the Accept header parser lets an unauthenticated attacker exhaust proxy worker threads. Affects Swift 1.9.1 up to the fixed 2.35.4/2.36.3/2.37.3 lines and 2.38.0. Backports available across epoxy, flamingo, gazpacho and hibiscus (see LP #2158771).
• OSSA-2026-032 — Neutron subnetpool onboarding cross-project mutation (CVE-2026-55707). Reported by Tim Shephard (roiai.ca): a project member can onboard subnets from another project's shared network into their own subnetpool, mutating routing, NAT and address-scope behaviour on the victim's routers. Only deployments with shared/RBAC-shared networks and the subnetpool onboarding extension enabled are affected. Fixed in Neutron 26.0.6, 27.0.4 and 28.0.2 (see LP #2152113).

On the distro side, Thomas Goirand (zigo) announced end of security support for Victoria, Wallaby, Xena and Yoga on Debian Bullseye, mirroring Bullseye's exit from Debian LTS. Zed remains supported via osbpo.debian.net; anyone still on those older releases should move to at least bookworm-zed. CVE/OSSA backport status continues to be tracked at the Debian OpenStack CVE-2026 wiki.

Development & Technical Decisions

Rethinking the threat model. Julia Kreger opened a thoughtful thread arguing that operator personas have shifted — many now push back on configuring dedicated management/control-plane networks or expect the software to "just work" securely by default. She proposes writing down an explicit community threat model that projects can extend, so operators facing infosec audits have real documentation to lean on. Early responses have been supportive; this is worth watching if you care about deployment security defaults.

Skyline and client IP forwarding. Ilia Petrov floated a design to have skyline-apiserver forward the original client address (via keystoneauth1.Session(original_ip=...)) so Keystone audit logs record real users rather than Skyline itself — mirroring Horizon's SECURE_PROXY_ADDR_HEADER behaviour. He's seeking feedback on the trust model and whether Kolla-Ansible would need a follow-up before he files a bug and posts a patch.

Horizon/Keystone scope mismatch. Radomir Dopieralski weighed in on Takashi Kajinami's ongoing multi-domain/scope discussion, arguing that Horizon's multi-domain story was never fully specified and that hard-wiring scope assumptions into code would undermine oslo.policy's flexibility. His preferred long-term fix is for Horizon to derive scope from the policy rules themselves, potentially with new oslo.policy helpers — though a short-term fallback mechanism may be pragmatic.

Operational debugging threads. Anthony Galica is hitting multipath=False on devstack while implementing an NVMe-TCP Cinder driver against a Hitachi backend, despite returning multiple portals — likely environmental, help wanted. Two Ubuntu 26 regressions also surfaced: noVNC failing to serve certificates with a setup that worked on Ubuntu 24, and instances losing routes on Ubuntu 26 compute hosts (Julia Kreger and Eugen Block suggest checking the DHCP agent).

Heads Up / Action Needed

• Indri cycle schedule feedback closes Friday, July 31. The release team's draft schedule for 2027.1 is up for community input, with a slightly shorter release length and a 4-week gap between M2 and M3 under discussion.
• TC and PTL nominations for 2027.1 "Indri" open August 5. Four TC seats are up. Goutham Pacha Ravi is actively encouraging TC candidacies; find current TC members on #openstack-tc on OFTC.
• 2026.2 "Hibiscus" is at R-9. Ironic PTL Riccardo Pittau confirmed he's cutting Ironic CWI deliverable releases this week in response to Előd Illés's release-team reminder.
• Ironic core team expansion: Jay Faulkner proposed Harald Jensas (hjensas) as an ironic-reviewer.

Community & Events

The TC merged two notable governance changes: the Contributor Experience Working Group is now formally established and organizing members via its wiki, and a house-rules update now lets routine liaison changes (release, security, etc.) land without a full roll-call vote. All five DPL-model teams (Ironic, Oslo, Release Management, Requirements, Freezer) have confirmed they will continue under distributed leadership into Indri, with some liaison rotations. Discussion of frickler's "reviewers-as-AC" proposal — counting accounts that actually exercised +2/maintainer privileges when determining electorate — continues in the TC.

The Ops Radio Hour convened Friday, July 31 at 1300 UTC, focused on updates to the Operator's Contributor Guide; jump into #openstack-ops:opendev.org on Matrix to follow along between calls.

Finally, Hony Ren asked the list for pointers on running OpenStack for AI/ML workloads — GPU management, Kubernetes integration, reference architectures. If you have production experience here, this is a good moment to share it: the community keeps getting this question and a canonical answer would help.