Stackers Network Digest — September 26, 2026

The Big Picture

The week was dominated by two forces: the imminent release of OpenStack 2026.2 "Hibiscus" on September 30, and an unusually heavy security-advisory batch — four OSSAs covering RCE, authentication bypass, cross-tenant disclosure, and authorization flaws across Octavia, Zaqar, Swift, and Blazar. Alongside that, operators and developers are lining up their PTG agendas, the eventlet-removal effort marks a major milestone at 60% of projects fully migrated, and Ubuntu 26.04 is already surfacing distro-level breakage in Cinder/os-brick that downstream deployers will want to watch.

Releases & Announcements

• Hibiscus ships September 30. The final release countdown week (R+0, Sep 28–Oct 2) is underway, per Előd Illés's release-team note. Project teams have their last chance to tag RCs this week.
• OpenInfra Live episode on Hibiscus airs Thursday, October 1 at 14:00 UTC. Allison Price is looking for PTLs/DPLs willing to represent their projects; the highlighted themes are trusted/secure infrastructure, AI/HPC workloads, and infrastructure efficiency at scale. Contact Allison this week if you want a slot (thread).
• Debian packages for Hibiscus are already usable. Thomas Goirand (zigo) has run Tempest against the release on Trixie and started the re-upload from Experimental to Unstable. Enable via extrepo enable openstack_hibiscus; package status is tracked at osbpo.debian.net/deb-status.
• TC election results are in for 2027.1: welcome/welcome-back to Artem Goncharov (gtema), Christian Berendt (berendt), Doug Goldstein (cardoe), and Jens Harbott (frickler). The TC elects its chair this week (summary).

Security

Four OpenStack Security Advisories landed within four days — patches are available for all supported branches (Epoxy, Flamingo, Gazpacho, Hibiscus, and master/Indri). Operators should treat this week as an urgent patching window.

• OSSA-2026-039 — Octavia RCE (CVE-2026-94572, CVE-2026-94571). HAProxy configuration injection via tls_ciphers, redirect_url, and redirect_prefix fields allows an authenticated tenant to execute arbitrary commands as root on the amphora, exfiltrate other tenants' TLS keys, and reach the control-plane network. Amphora provider only (advisory).
• OSSA-2026-040 — Blazar V2 lease API authorization bypass (CVE-2026-93852, CVE-2026-93854). Any authenticated user can list, modify, or delete leases across all projects. Deployers not using V2 can set api_v2_controllers to empty in [api] (advisory).
• OSSA-2026-041 — Swift tempurl cross-container disclosure (CVE-2026-97149). A single-object PUT TempURL signed with an account-level key can be replayed with X-Copy-From to copy and then read any object in the account. Mitigation: add x-copy-from to incoming_remove_headers in [filter:tempurl] (advisory).
• OSSA-2026-042 — Zaqar auth bypass (CVE-2026-97404). An empty URL-Signature header bypasses both Keystone auth and pre-signed URL verification; an unauthenticated remote attacker who knows a project UUID gets full queue/message/subscription access. WSGI transport only (advisory).

In related security-hygiene work, Anders Dovblad has proposed making Barbican's PKCS#11 login role configurable so HSM deployments (e.g. Thales Luna) can run day-to-day crypto with a least-privilege role instead of hard-coded CKU_USER.

Development & Technical Decisions

• Eventlet removal hits 60%. Hervé Beraud's cycle-end report tallies 59 of 98 tracked projects fully migrated, 13 in active progress, and only 4 genuinely stalled (zun, storlets, os-ken, masakari-monitors). Swift is running a major gunicorn migration (~29 open patches); Nova has defaulted conductor and compute to native threading since March. A PTG session on October 13 will plan the remaining work.
• Ubuntu 26.04 breakage in the storage stack. Simon Dodsley (Everpure CI) reports two independent issues on the 2027.1 baseline distro: (1) os-brick can't detach Fibre Channel volumes when multipath-tools ≥ 0.9.8 is used — affects every FC Cinder backend on cinder-volume and every Nova compute; (2) the Rust coreutils dd shipped by default on 26.04 cannot do O_DIRECT reads against iSCSI or dm-multipath devices, breaking Cinder's host-copy path. Both need attention before 2027.1 gates move.
• Neutron/OVN tap-mirror RFEs. Chanyeol Yoon (KT Cloud) has filed two RFEs to add OVN lport-type mirror sinks (bug 2168007) and security-group-style filtering rules (bug 2168008) to TaaS, unblocking IDS/packet-broker use cases without exposing hypervisor IPs. Depends on a long-idle ovsdbapp change. The Neutron drivers meeting was cancelled Friday, so discussion slips a week.
• Cinder control/data-plane split — design solicitation. Marek Chmiel is exploring how to refactor Cinder so cinder-api/scheduler live in a trusted control plane while cinder-volume/backup workers run in an untrusted data plane with no DB access. Two shapes proposed: extract "worker" components fed by RPC, or introduce a cinder-conductor. Feedback (and interest in upstreaming) is being solicited.
• Cinder stable-branch exception request. Dell is asking for a Gazpacho backport of review 993565 to restore PowerFlex 5.0 API compatibility — currently a full driver breakage for customers who upgrade the array.

Heads Up / Action Needed

• Patch the four OSSAs above as soon as your branch cadence allows.
• Hibiscus RC deadline this week; final release Sep 30.
• Requirements freeze exception denied for a neutron-lib / python-openstackclient bundle — the fixes will ship as stable releases in early October instead (note).
• Add your topics to the Ops/devs Q&A PTG etherpad and +1 the questions you care about — Ildikó Váncsa is coordinating joint sessions.
• Cancelled meetings: Neutron drivers (Sep 25), Tacker IRC (Sep 21), Ironic (Sep 28 — release-week break).

Community & Events

• PTG (virtual) is imminent; Kendall Nelson published the team list with Heat now included.
• Ops Radio Hour on Sep 25 featured a "Meet the Expert" session with Bloomberg's Mike Boruta on live migration; PTG planning continues on the etherpad.
• Public Cloud SIG held its bi-weekly on Sep 23.
• Governance/people: Stephen Finucane added Doug Goldstein (cardoe) to sdk-core. Takashi Kajinami pruned inactive members from the Storlets core team. The TC is weighing a cardoe proposal that PTLs formally attest to a core-reviewer audit at end-of-cycle.
• Manila hosted a share-server-replica code walkthrough on Sep 24 (patch topic, channel).
• Not-quite-community-but-relevant: Michiel Piscaer flagged that the Dutch government's 50k-node sovereign cloud design document dismisses OpenStack as "old school" in favour of a single large Kubernetes+KubeVirt cluster — a data point for anyone tracking OpenStack's position in the European sovereign-cloud conversation.