CVE-2026-44393: An issue was discovered in OpenStack oslo

Synopsis

This is a TLS hostname verification bypass in OpenStack oslo.messaging versions 1.0.0 through 17.3.0. The vulnerability is reachable over the network without authentication, but exploiting it requires the attacker to intercept control-plane traffic between OpenStack services and the RabbitMQ broker (a high-complexity position). A successful man-in-the-middle attacker can read and tamper with RPC and notification messages passing between all OpenStack services using the affected driver. No fix version has been published yet; HarborGuard tracks this advisory and will make a patched rebuild available as soon as upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be positioned to intercept network traffic between OpenStack services and the RabbitMQ broker over TLS, meaning over-the-network access to control-plane traffic is required.

• AuthenticationNot required

  No credentials or account are needed to carry out the man-in-the-middle interception; possession of any CA-signed certificate is sufficient.

• Victim interactionNot required

  No user or administrator action is required; exploitation occurs passively as OpenStack services make routine connections to the broker.

• Attack complexityDetail

  Attack complexity is high because the attacker must first achieve a network position capable of intercepting TLS control-plane traffic, which requires specific infrastructure access or a prior foothold.

Blast Radius

• Reads plaintext RPC call payloads and notification messages exchanged between all OpenStack services using oslo.messaging with RabbitMQ over TLS, exposing credentials, tokens, and operational data carried in those messages.
• Modifies RPC requests and responses in transit, allowing the attacker to inject malicious instructions into OpenStack service workflows or corrupt task queues.
• Impersonates the RabbitMQ broker to selectively drop, replay, or reorder messages, disrupting coordination between OpenStack control-plane services.