CVE-2026-44393: High severity Openstack oslo.messaging vulnerability
An issue was discovered in OpenStack oslo.messaging 1.0.0 through 17.3.0. The oslo.messaging RabbitMQ driver does not perform TLS hostname verification when connecting to the message broker. When sslcafile is configured, the driver enables certificate chain validation but does not pass the expected broker hostname into the underlying TLS stack. Any certificate signed by the deployment CA is accepted regardless of hostname, allowing an attacker who can intercept control-plane traffic to impersonate the RabbitMQ broker and perform a man-in-the-middle attack on RPC and notification traffic. All OpenStack services using oslo.messaging with RabbitMQ over TLS are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure ssl_ca_file is configured so certificate chain validation is enabled; this mitigates the acceptance of CA-signed certs without hostname verification, as the bug is that TLS hostname verification is not properly enforced.
OpenStack oslo.messaging (RabbitMQ driver) ssl_ca_file = configured (ca chain validation enabled) - Compensating control
Protect control-plane traffic that carries RPC/notification messages (used between OpenStack services and RabbitMQ) with network-level protections (e.g., prevent interception/mitM on the message path via segmentation and/or firewall restrictions).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44393?
CVE-2026-44393 has a severity score of 7.4, classified as high.
What are the potential impacts of CVE-2026-44393?
CVE-2026-44393 can lead to man-in-the-middle attacks due to the lack of TLS hostname verification when connecting to RabbitMQ.
How do I fix CVE-2026-44393?
To mitigate CVE-2026-44393, ensure that you implement proper TLS hostname verification in your OpenStack oslo.messaging configuration.
Which versions of OpenStack oslo.messaging are affected by CVE-2026-44393?
CVE-2026-44393 affects OpenStack oslo.messaging versions from 1.0.0 through 17.3.0.
Is it safe to use OpenStack oslo.messaging without addressing CVE-2026-44393?
Using OpenStack oslo.messaging without addressing CVE-2026-44393 poses security risks, particularly exposure to man-in-the-middle attacks.