Stackers Network Digest — October 24, 2026

The Big Picture

This week was dominated by the aftermath of the Indri PTG (held Oct 13–16) and an unusually heavy security pulse: five advisories landed on the same day across Ironic, Manila, Cinder, and oslo.utils. Nearly every project team posted its 2027.1 planning recap, revealing shared themes — reviewer burnout, AI-generated patch load, a push to split "reviewer" and "approver" core roles, and renewed focus on security rigor. Operators should prioritize the CVE patches below and note that 2025.1 "Epoxy" transitions to Unmaintained by end of October.

Security

Five coordinated disclosures went out, all with patches already proposed across supported branches:

• OSSA-2026-048 — Ironic (CVE-2026-89419): The generic PATCH /v1/nodes/{ident} lets callers bypass the set_maintenance/clear_maintenance policy checks via the generic baremetal:node:update policy. Affects a wide range of versions up through 39.0.1; see bug 2166510.
• OSSA-2026-047 — Ironic (CVE-2026-90458): The Redfish vendor_passthru endpoint allows a system-scoped admin to perform HTTP GET/DELETE on arbitrary BMC paths — worst case, wiping Redfish accounts. Only redfish hardware-type nodes are affected.
• OSSA-2026-046 — Manila (CVE-2026-71195): Non-owners could modify access rules, soft-delete/restore, back up, or tamper with export-location metadata of other projects' public shares. All deployments using public shares or export-location metadata are affected.
• OSSA-2026-045 — Cinder (CVE-2026-93856): The v3.3 "List messages" API leaks UUIDs of other projects' resources to any project-scoped member/reader. All Cinder deployments affected.
• OSSN-0111 — oslo.utils: The LUKS inspector (10.1.0–10.3.0) logs enough key material at DEBUG to decrypt a LUKSv1 image. Mitigation without upgrade: raise oslo_utils.imageutils._luks logger above DEBUG.

Separately, Pavlo Shchelokovskyy opened a thorny follow-up on OSSN-0108: Manila's CephFS driver implicitly creates Ceph users with the cluster default keyring type, so rotating to the new aes256k format breaks tenants running kernels <7.0. A prototype patch proposes per-access key-type selection — feedback welcome.

Ironic's own PTG summary notes this was "a security-dominated cycle" with a record number of embargoed issues, and the team plans more threat modeling and stricter spec requirements for sensitive changes.

Releases & Lifecycle

Epoxy → Unmaintained: Elõd Illés announced that 2025.1 Epoxy transitions to Unmaintained by end of October. Teams needing a final 2025.1 release must do it immediately; otherwise +1 the transition patches.

tooz release model: Following positive feedback, Takashi Kajinami is moving tooz back to cycle-with-intermediary via this patch.

Ironic release cadence: Working consensus at the PTG to move from three in-cycle releases to a twice-per-cycle model, balancing Metal3's needs against branch-maintenance cost.

PTG Recaps — Highlights Worth Knowing

Kendall Nelson is still chasing attendance data and summaries from ~22 teams for the wrap-up blog post. Posted summaries this week:

• Nova / Manila VirtioFS: Direction is to add hot attach and live migration without a new API microversion, using compute service version checks. Nova review capacity is the main constraint.
• Neutron: Tempest jobs moving to Ubuntu Resolute (26.04); OVS/OVN bumps to latest LTS; the standalone ovn-bgp-agent vs. in-tree OVN BGP service plugin question remains unresolved; neutron-sfc to be removed from tree. Neutron ranked #1 in AI usage per the PTG agentic etherpad.
• Manila: Will split core into reviewers (+2) and approvers (+W) — following Nova, Ironic, and the OpenStack SDK. December Outreachy intern will focus on JSON schema validation.
• Ironic: Multi-year themes identified: modernizing auth / standalone RBAC without Keystone; retiring stale specs.
• Cyborg: Freezing and deprecating python-cyborgclient in favor of openstacksdk/OSC; deprecating untested experimental drivers. Sean Mooney has also proposed removing 13 inactive Cyborg cores.
• TC: Cross-project goals continue around Eventlet, privsep, and secure RBAC. The TC has not adopted the OIF AI policy; an OpenStack-specific proposal is expected.
• Agentic Workflows: The openstack/agentic-workflows repo needs maintainers; recommendation is to use AGENTS.md as a routing file to existing RST docs rather than duplicating in Markdown.
• Additional recaps: Tacker, Horizon, Watcher, Contributor Experience WG, and the Ops session recap (video).

Development & Technical Decisions

• Glance /v2/tasks removal: Abhishek Kekane proposes advertising Image API 2.19 as the discoverable marker for removing the long-deprecated legacy tasks API. A branchless Tempest skip lands first, then Glance removes the endpoints. Feedback wanted on whether any refstack/interop or downstream consumer still depends on /v2/tasks.
• openstack-helm merge: Vladimir Kozhukalov plans to merge openstack-helm-images into openstack-helm around mid-November, mirroring the March 2025 helm-infra merge. Both repos will freeze — land or abandon pending changes before then. Objections welcome now.
• Heat CFN API usage survey: Takashi Kajinami is asking operators whether anyone actually uses the AWS CFN-compatible API beyond signal/wait. Upcoming Keystone EC2-credential changes would make the create/update/delete paths effectively unmaintainable, so the team is leaning toward removing them. Reply if you use this.
• Zun Eventlet removal: Hongbin Lu has volunteered to drive this PTG follow-up.
• Cinder/os-brick/Nova image encryption: The volume/image encryption popup meeting restarts Mondays at 13 UTC in #openstack-meeting.

Heads Up / Action Needed

• Patch now: Ironic, Manila, Cinder, oslo.utils per OSSAs/OSSN above.
• End of October: 2025.1 Epoxy transitions to Unmaintained — final releases must happen immediately.
• Mid-November: openstack-helm / openstack-helm-images repo freeze and merge.
• Feedback requested: Glance 2.19 marker for /v2/tasks removal; Heat CFN API usage; Manila CephFS keyring-type approach.
• Infra: wiki.openstack.org is offline — see the OpenDev service-announce thread for status.

Community & Events

The TC resumed its weekly meeting cadence on Oct 20 (agenda). The next Ops Radio Hour is October 30, 1300 UTC. The Manila weekly meeting was cancelled Oct 22 and resumes Oct 29. On the governance side, Dmitriy Rabotyagov completed an openstack-ansible core group cleanup after the feedback window closed with no objections.