Skip to content
Fencer Vulns
high 7.4

CVE-2026-44393 json

OpenStack oslo.messaging does not verify RabbitMQ broker hostname during TLS handshake

published 2026-06-04 5 mo ago modified 2026-08-27 2 mo ago also GHSA-76qh-xr7q-h39m , PYSEC-2026-3492 , EUVD-2026-34294

cvss
7.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 6%
public exploits
0
none known

Summary

An issue was discovered in OpenStack oslo.messaging 1.0.0 through 17.3.0. The oslo.messaging RabbitMQ driver does not perform TLS hostname verification when connecting to the message broker. When ssl_ca_file is configured, the driver enables certificate chain validation but does not pass the expected broker hostname into the underlying TLS stack. Any certificate signed by the deployment CA is accepted regardless of hostname, allowing an attacker who can intercept control-plane traffic to impersonate the RabbitMQ broker and perform a man-in-the-middle attack on RPC and notification traffic. All OpenStack services using oslo.messaging with RabbitMQ over TLS are affected.

Patch / fix

  • Red Hat Red Hat OpenStack Platform 16.2 0:10.2.4-2.20260710155333.82281a0.el8ost
  • python-oslo.messaging Debian 12 14.0.3-0+deb12u1
  • python-oslo.messaging Debian 13 16.1.0-3+deb13u1
  • python-oslo.messaging Debian 14 17.3.0-4

debian advisories DEBIAN-CVE-2026-44393

  • etcd openstack 16.2 3.3.23-22.el8ost
  • erlang openstack 16.2 23.3.4.18-2.el8ost
  • erlang-ssl openstack 16.2 23.3.4.18-2.el8ost
  • erlang-asn1 openstack 16.2 23.3.4.18-2.el8ost
  • erlang-erts openstack 16.2 23.3.4.18-2.el8ost
  • erlang-hipe openstack 16.2 23.3.4.18-2.el8ost
  • erlang-sasl openstack 16.2 23.3.4.18-2.el8ost
  • erlang-snmp openstack 16.2 23.3.4.18-2.el8ost

red hat advisories RHSA-2026:54757

  • python-oslo.messaging openSUSE Tumbleweed 18.1.0-1.1

opensuse advisories openSUSE-SU-2026:10973-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-44393 updated cvss 7.4

oslo.messaging: openstack: OpenStack oslo.messaging: Man-in-the-middle attack via improper TLS hostname verification

  • Red Hat OpenStack Platform 17.1 python3-oslo-messaging Red Hat OpenStack Platform 18.0 python-oslo-messaging
    affected: workaround, no fix available
  • Red Hat OpenStack Platform 16.2 python-oslo-messaging 10.2.4-2.20260710155333.82281a0.el8ost, python3-oslo-messaging 10.2.4-2.20260710155333.82281a0.el8ost
    fixed: vendor fix RHSA-2026:54757
  • Red Hat OpenShift Container Platform 4 python-oslo-messaging, python3-oslo-messaging, python3-oslo-messaging-tests
    not affected: vulnerable code not in execute path
  • Red Hat OpenStack Platform 16.2 etcd 3.3.23-22.el8ost, erlang 23.3.4.18-2.el8ost, python-pyasn1 0.4.6-4.el8ost, erlang-ssl 23.3.4.18-2.el8ost, python3-pyasn1 0.4.6-4.el8ost, erlang-asn1 23.3.4.18-2.el8ost, +79 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
5 mo ago

Exploit prediction

0.17% chance of exploitation in the next 30 days, higher than 6% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CNA 3.1 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
GitHub 3.1 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
OSV 3.1 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
pypi oslo-messaging
>=1.0.0, <=17.3.0
 no fix listed

Affected products

  • Red Hat Red Hat OpenStack Platform 16.2
  • Red Hat Red Hat OpenShift Container Platform 4
  • Red Hat Red Hat OpenStack Platform 17.1
  • Red Hat Red Hat OpenStack Platform 18.0

Classification

Weakness
  • CWE-297 Improper Validation of Certificate with Host Mismatch
  • CWE-295 Improper Certificate Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.