Stackers Network Digest — October 10, 2026

The Big Picture

The week was dominated by two things: a wave of security advisories (Mistral, Zaqar, Gnocchi, Ironic) landing just before the Project Teams Gathering, and PTG prep itself. The Indri 2027.1 cycle has officially begun — Hibiscus shipped the week prior — and most project teams are cancelling IRC meetings in favor of the vPTG running October 12–16. Alongside that, several projects are doing core-reviewer housekeeping, and operator-focused topics (contributor sustainability, auth/authz future, GPU/IB passthrough topology) are being teed up for discussion next week.

Security

A heavy week on the VMT front — operators should plan patching immediately:

• OSSA-2026-044 — Mistral (four CVEs): Four separate authorization and privilege vulnerabilities, including an RCE in the std.ssh_proxied action provider (CVE-2026-93858), cross-project workflow sharing abuse (CVE-2026-93861), and v2 API write paths that can clobber another project's resources (CVE-2026-97147). Affects Mistral <20.1.1, ==21.0.0, ==22.0.0, ==23.0.0. All deployments exposing the Mistral API are affected. Advisory thread.
• OSSA-2026-043 — Zaqar WebSocket (CVE-2026-107363): An authenticated attacker knowing a target project UUID can substitute it in WebSocket frames and enumerate/modify/delete that project's queues. Only deployments using the WebSocket transport with Keystone auth are affected; patches cover epoxy through indri. Errata 1.
• OSSN-0110 — Ironic basic-auth credential leak: When [deploy]/image_server_auth_strategy is set to HTTP(S) Basic Auth, Ironic sends the operator's image-server credentials to any host it fetches image data from — including tenant-controlled URLs set via instance_info/image_source. Fix adds a new image_server_auth_hosts allowlist; Ironic will flip image_server_auth_permit_unknown_hosts to False by default in 2027.1. Glance-backed deployments are not affected. Advisory, bug 2162816.
• OSSN-0109 — Gnocchi cross-project metric association: POST /v1/metric applied no policy on the resource_id in the request body, letting an attacker inject measures into another project's resources — potentially triggering Aodh alarms and Heat scaling actions in a victim project. Fixed in Gnocchi 4.6.6 and later; 4.7.0 is vulnerable. Advisory.

Releases & Development

The 2027.1 Indri cycle is officially open, with the coordinated release targeted for March 24, 2027 — R-23 countdown mail has gone out (release countdown). A Hibiscus recap aired on OpenInfra Live on October 1.

On the technical side, Thomas Goirand (zigo) tracked down a long-standing uwsgi bug breaking Transfer-Encoding: chunked under TLS, which was blocking Glance from running under uwsgi without a TLS-terminating proxy. The upstream fix is in unbit/uwsgi#2781; the Glance team has historically worked around it with mod_proxy, but zigo is pushing to get this fixed in distros. Thread.

Moonsang Yhu (opening a discussion before writing a spec) is gauging interest in exposing host PCIe/NUMA topology to passthrough guests in Nova, using QEMU's pxb-pcie to let NCCL/hwloc see which GPUs sit near which NICs. Measured gains on an 8xA100 + ConnectX-7 workload went from 27.6 GB/s to 55.6 GB/s on NCCL all_reduce. The old Juno/Kilo PCIe NUMA spec landed scheduling but never the guest-side XML, and operators currently hack it in with libvirt hooks. Thread.

Also worth noting: a renewed debate about authentication and authorization's future in OpenStack, kicked off by Julia Kreger's pre-PTG response to a sweeping proposal that originated outside the community. Her core message: there's real technical merit, but it needs an operator-readable summary, a stepwise migration path rather than a fresh start, and probably a dedicated new project rather than an across-the-board mandate. Expect this to come up at the PTG. Thread.

PTG Next Week (Oct 12–16)

The vPTG runs October 12–16. The TC-led schedule — TC weekly summary — has several cross-cutting sessions worth flagging:

• Mon 1300 UTC — TC + Community Leaders forum
• Mon 1400 UTC — SRBAC closure and the future of OpenStack's RBAC model
• Mon 1500 UTC — AI-assisted code contributions and reviews with the TaCT SIG (openstack/agentic-workflows)
• Tue 1300 UTC — Eventlet Removal working session
• Mon/Tue 1600–1800 UTC — Contributor Experience WG kickoff
• Fri 1300 UTC — Ops session (etherpad)
• Fri 1600–1800 UTC — TC working sessions on Horizon/Skyline UI/UX, Keystone's future, and the Technical Vision

Project schedules published this week: Neutron (Tue/Wed only), Manila (incl. VirtioFS cross-session with Nova and sovereign-clouds with Cinder), Masakari, Ironic, and Cyborg. Thomas Goirand is also requesting a slot to present Vigie, a new operator-focused admin API covering gaps like project purging and compute/network node evacuation (thread).

Weekly IRC meetings cancelled this week and/or next: Neutron (CI/Team/Drivers), Ironic (Oct 12), Cyborg (Oct 13), Watcher (Oct 15), Kolla (Oct 7 and 14).

Heads Up / Action Needed

• Patch Mistral, Zaqar, Gnocchi, and Ironic (basic-auth) per the advisories above.
• openstack-ansible core cleanup: Dmitriy Rabotyagov proposes removing seven inactive cores (including Mohammed Naser, Kevin Carter, Logan V, Dave Wilde). Objections by Oct 16. Thread.
• Similar core/group cleanups are also underway in Zaqar, Masakari (Jegor van Opdorp, SamP, Tushar Patil removed), and Mistral (incl. Renat Akhmerov) — a visible community-wide trend driven partly by stale-permission security concerns.
• Stackalytics is stale: default_data.json appears to have stopped reloading on stackalytics.io since around March 2026, so affiliation changes and the Indri release aren't reflected. Someone with site access is needed. Thread.

Community & Governance

The TC confirmed its 2027.1 office-bearers: Goutham Pacha Ravi (gouthamr) continues as chair, with Doug Goldstein (cardoe) and Michał Nasiadka (mnasiadka) as vice-chairs; Christian Berendt is election liaison; Amy Marrich joins Goutham as VMT liaison.

Ildikó Vancsa shared the Hibiscus contributor metrics analysis: incoming changes rose 24.5% and active maintainers rose 10.6% — the first maintainer-count increase since Epoxy — but reviewer growth is still not keeping up with incoming change volume. The analysis is tied to ongoing efforts to grow the Nova maintainer team and to codify project-wide core-reviewer criteria. Thread.

Finally, Neutron's weekly bug triage flagged a cluster of significant OVN/OVSDB issues, including a BGP reconciler self-deadlock (bug 2168768) and an OVN API-worker infinite loop in _init_hash_ring after container restarts where a reused PID causes a stale /tmp/neutron_start_time to be read (bug 2169231) — worth watching if you run Neutron OVN in containers.