Skip to content
fr Sign in
7.4 High

CVE-2026-44393 An issue was discovered in OpenStack oslo.messaging 1.0.0 through 17.3.0

Description

An issue was discovered in OpenStack oslo.messaging 1.0.0 through 17.3.0. The oslo.messaging RabbitMQ driver does not perform TLS hostname verification when connecting to the message broker. When ssl_ca_file is configured, the driver enables certificate chain validation but does not pass the expected broker hostname into the underlying TLS stack. Any certificate signed by the deployment CA is accepted regardless of hostname, allowing an attacker who can intercept control-plane traffic to impersonate the RabbitMQ broker and perform a man-in-the-middle attack on RPC and notification traffic. All OpenStack services using oslo.messaging with RabbitMQ over TLS are affected.

Affected products and versions

Product Affected versions Fixed in
n/a Versions not published
Red Hat OpenShift Container Platform 4 Versions not published
Red Hat OpenStack Platform 16.2 Versions not published
Red Hat OpenStack Platform 17.1 Versions not published
Red Hat OpenStack Platform 18.0 Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of n/a

The 144658 CVEs of n/a →
CVE-2026-106713 An issue in FreeReels for Android version 2.3.11 allows a remote attacker to obtain sensitive information via the… Not rated CVE-2026-106715 NewsBreak for Android version 26.21.0 treats data:text/html; URLs as trusted in its WebView JavaScript bridge origin… Not rated CVE-2026-106714 Chewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading it… Not rated CVE-2026-106716 ReelShort for Android version 3.8.55 loads an attacker-controlled activityUrl supplied through its cmsvictor://open deep… Not rated
Track this CVE