CVE-2026-44393 Details

A vulnerability exists in the OpenStack oslo.messaging RabbitMQ driver, affecting versions 1.0.0 prior to 16.2.0, 17.0.0 prior to 17.1.1, and 17.2.0 prior to 17.3.1. The issue arises because the driver fails to verify the RabbitMQ broker's hostname during TLS connections, even though it validates the certificate chain when a CA file is specified. This oversight allows an attacker with control-plane network access to intercept traffic and impersonate the RabbitMQ broker, leading to a man-in-the-middle attack on RPC and notification communications. All OpenStack services that use oslo.messaging with RabbitMQ over TLS are vulnerable.

Users can upgrade to OpenStack oslo.messaging version 18.0.0 (2026.2/Hibiscus), which includes the fix and enables hostname verification by default. For those on stable branches, it's recommended to set the 'ssl_enforce_hostname_verification' option to true in the '[oslo_messaging_rabbit]' configuration, ensuring that RabbitMQ broker certificates have the appropriate SAN entries matching the hostnames used in the 'transport_url'. Before making this change, verify that Kombu version 5.2.0 or higher is being used.