Vulnerability · Published Jun 4, 2026 · Assigned by mitre
CVE-2026-44393
High 7.4
In plain English
A high-severity improper certificate validation in the python-oslo.messaging package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An issue was discovered in OpenStack oslo.messaging 1.0.0 through 17.3.0. The oslo.messaging RabbitMQ driver does not perform TLS hostname verification when connecting to the message broker. When ssl_ca_file is configured, the driver enables certificate chain validation but does not pass the expected broker hostname into the underlying TLS stack. Any certificate signed by the deployment CA is accepted regardless of hostname, allowing an attacker who can intercept control-plane traffic to impersonate the RabbitMQ broker and perform a man-in-the-middle attack on RPC and notification traffic. All OpenStack services using oslo.messaging with RabbitMQ over TLS are affected.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | python-oslo.messaging | 14.0.3-0+deb12u1 | DEBIAN-CVE-2026-44393 |
| Debian:13 | python-oslo.messaging | 16.1.0-3+deb13u1 | DEBIAN-CVE-2026-44393 |
| Debian:14 | python-oslo.messaging | 17.3.0-4 | DEBIAN-CVE-2026-44393 |
| PyPI | oslo-messaging | no fix listed | GHSA-76qh-xr7q-h39m |
| PyPI | oslo-messaging | no fix listed | PYSEC-2026-3492 |
| Ubuntu:22.04:LTS | python-oslo.messaging | no fix listed | UBUNTU-CVE-2026-44393 |
| Ubuntu:24.04:LTS | python-oslo.messaging | no fix listed | UBUNTU-CVE-2026-44393 |
| Ubuntu:25.10 | python-oslo.messaging | no fix listed | UBUNTU-CVE-2026-44393 |
| Ubuntu:26.04:LTS | python-oslo.messaging | no fix listed | UBUNTU-CVE-2026-44393 |
| Ubuntu:26.10 | python-oslo.messaging | no fix listed | UBUNTU-CVE-2026-44393 |
Affected products (as reported)
Weakness: CWE-297, CWE-295 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
References
- https://bugs.launchpad.net/oslo.messaging/+bug/2150316
- https://wiki.openstack.org/wiki/OSSN/OSSN-0096
- https://access.redhat.com/security/cve/CVE-2026-44393 vdb-entry, x_refsource_REDHAT
- RHBZ#2484835 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44393.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:54757 vendor-advisory, x_refsource_REDHAT