Executive brief
OpenStack oslo.messaging is a library used by cloud services to communicate with one another via a message broker. A security flaw in this library fails to verify that the security certificate provided by the message broker actually belongs to that broker. This could allow an attacker with access to the internal network to intercept or modify sensitive communications between cloud services, potentially leading to unauthorized data access or service disruption.
Technical details
A vulnerability exists in the OpenStack oslo.messaging RabbitMQ driver (specifically within the _fetch_ssl_params function) where TLS hostname verification is not performed during the handshake. While the driver enables certificate chain validation when 'ssl_ca_file' is configured, it fails to pass the expected broker hostname to the underlying TLS stack (py-amqp/kombu). An attacker capable of intercepting control-plane traffic can present any certificate signed by the deployment's trusted Certificate Authority to impersonate the RabbitMQ broker. This enables man-in-the-middle (MITM) attacks against RPC and notification traffic used by core services like Nova, Neutron, and Cinder. The issue is tracked as OSSN-0096 and affects versions 1.0.0 through 17.3.0.
Affected products
- OpenStack oslo.messaging 1.0.0 - 17.3.0
- Red Hat Red Hat OpenStack Platform 16.2, 17.1, 18.0
- Red Hat Red Hat OpenShift Container Platform 4
Timeline
- 2026-04-25: disclosed: Bug reported to OpenStack Launchpad
- 2026-06-04: advisory: Initial GHSA and NVD publication
- 2026-07-15: other: Advisory updated with Red Hat impact data