CVE-2026-44393
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
In OpenStack oslo.messaging versions 1.0.0 through 17.3.0, the RabbitMQ driver does not perform TLS hostname verification. Even with ssl_ca_file configured, any certificate signed by the CA is accepted, enabling man-in-the-middle attacks on RPC and notification traffic.
Risk Assessment
Attackers can intercept control-plane traffic by impersonating the RabbitMQ broker, leading to disclosure or modification of sensitive data exchanged between OpenStack services.
Recommendation
Upgrade oslo.messaging to version 17.3.1 or later, which enforces hostname verification. Until then, consider using additional authentication mechanisms like client certificates.
Original NVD description (English source)
An issue was discovered in OpenStack oslo.messaging 1.0.0 through 17.3.0. The oslo.messaging RabbitMQ driver does not perform TLS hostname verification when connecting to the message broker. When ssl_ca_file is configured, the driver enables certificate chain validation but does not pass the expected broker hostname into the underlying TLS stack. Any certificate signed by the deployment CA is accepted regardless of hostname, allowing an attacker who can intercept control-plane traffic to impersonate the RabbitMQ broker and perform a man-in-the-middle attack on RPC and notification traffic. All OpenStack services using oslo.messaging with RabbitMQ over TLS are affected.