Is CVE-2026-44393 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44393 being exploited in the wild.

How severe is CVE-2026-44393?

High severity, with a CVSS score of 7.4, published 4 June 2026.

Which products and versions are affected?

OpenStack Oslo.Messaging >=1.0.0 =17.0.0 =17.2.0 <17.3.1, 1.0.0 - 17.3.0; oslo-messaging (PyPI) ECOSYSTEM:introduced=1.0.0,last_affected=17.3.0.

Is there a fix for CVE-2026-44393?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-44393 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-44393?

Check whether you run OpenStack Oslo.Messaging or oslo-messaging (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44393: OpenStack oslo.messaging TLS hostname verification failure in RabbitMQ driver

Q: Is there a fix for CVE-2026-44393?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-44393 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-44393?

Check whether you run OpenStack Oslo.Messaging or oslo-messaging (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44393 · Severity: high · CVSS 7.4 · Published 2026-06-04

OpenStack oslo.messaging is a library used by cloud services to communicate with one another via a message broker. A security flaw in this library fails to verify that the security certificate provided by the message broker actually belongs to that broker. This could allow an attacker with access to the internal network to intercept or modify sensitive communications between cloud services, potentially leading to unauthorized data access or service disruption.

Vendors: OpenStack, PyPI.

Quick answers

Is CVE-2026-44393 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44393 being exploited in the wild.
How severe is CVE-2026-44393?: High severity, with a CVSS score of 7.4, published 4 June 2026.
Which products and versions are affected?: OpenStack Oslo.Messaging >=1.0.0 <16.2.0, >=17.0.0 <17.1.1, >=17.2.0 <17.3.1, 1.0.0 - 17.3.0; oslo-messaging (PyPI) ECOSYSTEM:introduced=1.0.0,last_affected=17.3.0.
Is there a fix for CVE-2026-44393?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-44393 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-44393?: Check whether you run OpenStack Oslo.Messaging or oslo-messaging (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the OpenStack oslo.messaging RabbitMQ driver (specifically within the _fetch_ssl_params function) where TLS hostname verification is not performed during the handshake. While the driver enables certificate chain validation when 'ssl_ca_file' is configured, it fails to pass the expected broker hostname to the underlying TLS stack (py-amqp/kombu). An attacker capable of intercepting control-plane traffic can present any certificate signed by the deployment's trusted Certificate Authority to impersonate the RabbitMQ broker. This enables man-in-the-middle (MITM) attacks against RPC and notification traffic used by core services like Nova, Neutron, and Cinder. The issue is tracked as OSSN-0096 and affects versions 1.0.0 through 17.3.0.

Affected products

OpenStack oslo.messaging 1.0.0 - 17.3.0
Red Hat Red Hat OpenStack Platform 16.2, 17.1, 18.0
Red Hat Red Hat OpenShift Container Platform 4

Identifiers

CVE-2026-44393
GHSA-76qh-xr7q-h39m
PYSEC-2026-3492

Timeline

2026-04-25: disclosed: Bug reported to OpenStack Launchpad
2026-06-04: advisory: Initial GHSA and NVD publication
2026-07-15: other: Advisory updated with Red Hat impact data

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.