{"cve":"CVE-2026-44393","nvd":{"published":"2026-06-04T16:16:38.497","modified":"2026-08-27T13:18:04.500","status":"Awaiting Analysis","description":"An issue was discovered in OpenStack oslo.messaging 1.0.0 through 17.3.0. The oslo.messaging RabbitMQ driver does not perform TLS hostname verification when connecting to the message broker. When ssl_ca_file is configured, the driver enables certificate chain validation but does not pass the expected broker hostname into the underlying TLS stack. Any certificate signed by the deployment CA is accepted regardless of hostname, allowing an attacker who can intercept control-plane traffic to impersonate the RabbitMQ broker and perform a man-in-the-middle attack on RPC and notification traffic. All OpenStack services using oslo.messaging with RabbitMQ over TLS are affected.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","score":7.4},"cwes":["CWE-297","CWE-295"],"references":["https://bugs.launchpad.net/oslo.messaging/+bug/2150316","https://wiki.openstack.org/wiki/OSSN/OSSN-0096","https://access.redhat.com/errata/RHSA-2026:54757","https://access.redhat.com/security/cve/CVE-2026-44393","https://bugzilla.redhat.com/show_bug.cgi?id=2484835"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:37:48.043517290+00:00"},"epss":{"cve":"CVE-2026-44393","score":0.00172,"percentile":0.06582,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-76qh-xr7q-h39m","url":"https://osv.dev/vulnerability/GHSA-76qh-xr7q-h39m","summary":"OpenStack oslo.messaging does not verify RabbitMQ broker hostname during TLS handshake","modified":"2026-07-29T05:15:34.487742035Z","packages":[{"ecosystem":"PyPI","name":"oslo-messaging","purl":"pkg:pypi/oslo-messaging","ranges":[">=1.0.0 <=17.3.0"],"fixed":[]}]},{"id":"PYSEC-2026-3492","url":"https://osv.dev/vulnerability/PYSEC-2026-3492","summary":"OpenStack oslo.messaging does not verify RabbitMQ broker hostname during TLS handshake","modified":"2026-07-28T09:15:10.483381962Z","packages":[{"ecosystem":"PyPI","name":"oslo-messaging","purl":"pkg:pypi/oslo-messaging","ranges":[">=1.0.0 <=17.3.0"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}