CVE-2026-44393: python-oslo.messaging
Vulnerability summary
CVE-2026-44393 is a high (CVSS 7.4) vulnerability in python-oslo.messaging. EPSS estimates a 0.28% chance of exploitation in the next 30 days, higher than 19.3% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 04-06-2026PublishedVulnerability first disclosed.
- 27-08-2026Last modifiedVulnerability information updated.
Description
An issue was discovered in OpenStack oslo.messaging 1.0.0 through 17.3.0. The oslo.messaging RabbitMQ driver does not perform TLS hostname verification when connecting to the message broker. When ssl_ca_file is configured, the driver enables certificate chain validation but does not pass the expected broker hostname into the underlying TLS stack. Any certificate signed by the deployment CA is accepted regardless of hostname, allowing an attacker who can intercept control-plane traffic to impersonate the RabbitMQ broker and perform a man-in-the-middle attack on RPC and notification traffic. All OpenStack services using oslo.messaging with RabbitMQ over TLS are affected.
CVSS metrics
6 scores · 6 sources · 1 version- OSV · PypiEcosystem advisory · calculated7.4HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · UbuntuEcosystem advisory · calculated7.4HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · DebianEcosystem advisory · calculated7.4HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · ChainguardEcosystem advisory · calculated7.4HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- NVDNIST7.4HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS trend
Probability
0.28%
Chance of exploitation in the next 30 days
Percentile
19%
Versus all other CVEs
30-day change
+0.11 pp
From 0.17% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-297Improper Validation of Certificate with Host MismatchThe product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.
- CWE-295Improper Certificate ValidationThe product does not validate, or incorrectly validates, a certificate.
Affected systems
Chainguard38 products
- openstack-barbican-2025.2All versions (No fix recorded)
- openstack-designate-2025.2All versions (No fix recorded)
- openstack-designate-2026.1All versions (No fix recorded)
- openstack-glance-2025.1All versions (No fix recorded)
- openstack-glance-2025.1-fipsAll versions (No fix recorded)
Debian1 product
- python-oslo.messaging< 14.0.3-0+deb12u1 | < 16.1.0-3+deb13u1 | < 17.3.0-4
Opensuse1 product
- python-oslo.messaging&distro=openSUSE Tumbleweed< 18.1.0-1.1
PyPI1 product
- oslo-messaging≥ 1.0.0, ≤ 17.3.0
Ubuntu1 product
- python-oslo.messagingAll versions (No fix recorded)
5 vendors · 42 products
