Stackers Network Digest — October 31, 2026

The Big Picture

This week was dominated by security: the VMT published two OpenStack Security Advisories on the same day — a keystonemiddleware access-rules bypass and an Ironic conductor DoS — both with patches landed across every supported stable branch. Around that, the community continued digesting the 2027.1 "Indri" PTG, with summaries, cross-project follow-ups, and action items flowing onto the mailing list. On the infrastructure side, wiki.openstack.org going offline is prompting projects to migrate agendas and docs to etherpad and git in real time.

Security

Two OSSAs dropped on October 29, both worth immediate attention from operators:

• OSSA-2026-050 — keystonemiddleware access_rules bypass via X-Service-Token (CVE-2026-115642). Reported by Nassim Abbaoui (OVHcloud). A client holding an access-restricted application credential can bypass its restrictions by supplying a custom X-Service-Token header, resulting in elevation of privileges. Affected versions: keystonemiddleware <10.9.2, >=10.10.0 <10.12.2, >=11.0.0 <12.0.1, and >=13.0.0 <13.0.2. Fixes have been proposed for epoxy through indri; see Launchpad #2162748. Deployments using application credential access_rules or token binding should patch quickly.
• OSSA-2026-049 — Ironic conductor DoS via gzip-bomb configdrive (CVE-2026-115638). Reported by Jay Faulkner (G-Research). A base64/gzipped configdrive submitted to /v1/nodes/provision_state can be expanded to exhaust memory or disk on the conductor. Relevant to any environment where users can deploy nodes directly via Ironic. Patches are posted for caracal (unmaintained), epoxy, flamingo, gazpacho, hibiscus, indri, and bugfix branches 37.0/38.0, though unmaintained/2024.1 and the two bugfix branches will not get fresh releases.

Releases & Announcements

No formal project releases crossed the list this week, but the Indri (2027.1) cycle is now firmly underway. The TC's weekly summary from Goutham Pacha Ravi notes we are at R-21, with milestone-1 on November 19 (TC summary). The Cinder spec freeze on the Indri schedule is close enough that Brian Rosmaita called an impromptu Festival of Specs Reviews for October 30, 14:00–16:00 UTC.

Development & Technical Decisions

PTG summaries are landing. Cyril Roelandt issued a final call for PTG data and summary submissions — PTLs who haven't filed yet should do so now. Published this week:

• OpenStack-Ansible 2027.1 plan from Dmitriy Rabotyagov — PKI role improvements (no standalone certs on deploy host, cert rotation), HAProxy frontend refactor, initial HTTP/2 for httpd/Apache backends with a plan to replace uWSGI, and migration to unified limits (summary).
• Cinder/Nova RemoteFS/NFS volume encryption cross-project session summary from Markus Hentsch, feeding into bug 2164526 and the broader attachment/image-encryption work (summary).

Technical Committee topics in flight. The TC is time-boxing its review of the Rust-in-OpenStack use-case analysis (Keystone as the subject), with members asked to cast explicit votes. The discussion also pulled in the EU's Cyber Resilience Act. On the goals side, Clark Boylan flagged that privsep's memory footprint is contributing to CI instability in all-in-one jobs — Mikal Still has started digging in and more help is wanted. Agenda tracking has moved to an etherpad.

Barbican-UI revival. Barbican PTL Mauricio Harley confirmed Barbican will keep barbican-ui under its governance, folding it into the normal release cycle alongside barbican and python-barbicanclient, with a dedicated barbican-ui-core review group (thread).

Manila CIFS semantics. Inyong Hong (Samsung) asked whether CIFS backends supporting both IP and user access rules should treat them as independent layers (per a PowerScale fix) or leave it driver-specific — an open design question for the Manila team.

Operator pain points. Two sharp reports worth watching: Dharani D hit recurring SQLAlchemy QueuePool exhaustion plus eventlet AssertionError in Neutron on 2024.1 (Caracal) under Kolla-Ansible with PyMySQL (thread, referencing bug 2058018); and Subasri R reported that openstack-exporter marks the whole scrape down when any single service API is slow or returns 5xx, asking for per-request timeouts (thread, see upstream issue #660).

Stable policy reminder. Erlon Cruz reiterated on behalf of the Cinder team that cinder change 993565 is too large to backport under the stable-branches policy, suggesting the author split it into a targeted patch if they want to pursue an exception.

Infrastructure: wiki.openstack.org is offline

Jay Faulkner put the choice bluntly: either someone volunteers to pay off the wiki's devops tech debt, or projects migrate off it. Ironic has already moved its meeting agenda to etherpad and relocated doc links to git-based docs, using the Internet Archive to recover content. Neutron followed suit, moving its drivers meeting agenda to an etherpad tracked via this irc-meetings change. Expect more projects to make the same move in the coming weeks — if you reference the wiki in docs, bookmarks, or tooling, now is the time to audit.

Heads Up / Action Needed

• Patch keystonemiddleware and Ironic for OSSA-2026-050 and OSSA-2026-049 (see Security above).
• Submit your PTG summary if your project hasn't — final call is out.
• Cinder spec authors: join the Festival of Specs Reviews, Friday Oct 30, 14:00–16:00 UTC on Meet, etherpad here.
• Indri milestone-1: November 19, 2026.
• FOSDEM 2027 Virtualization & Cloud Infrastructure devroom CFP closes November 23 (submit); acceptances December 1, devroom January 30.
• TC Rust-use-case vote was due October 27; follow-up expected on the TC agenda.

Community & Events

• Cinder is now holding the final meeting of each month over video; connection info on the cycle meetings etherpad.
• Ops Radio Hour runs Friday October 30 at 13:00 UTC (Ildikó Vancsa published both a date-corrected reminder and the next week's notice; the October 30 session will reflect on PTG discussions and plan 2027 topics) — etherpad, chat in the Matrix room.
• Chicago, week of November 15: SC26 (Nov 15–20, including Stig Telfer's BoF on open-source and sovereign infrastructure for HPC/AI), Ceph Day Chicago on Nov 16, and OpenInfra Day North America on Nov 17.