GHSA-76qh-xr7q-h39m

Suggest an improvement
Source
https://github.com/advisories/GHSA-76qh-xr7q-h39m
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-76qh-xr7q-h39m/GHSA-76qh-xr7q-h39m.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-76qh-xr7q-h39m
Aliases
Downstream
CGA (74)
Published
2026-06-04T18:30:31Z
Modified
2026-07-29T05:15:34Z
Severity
  • 7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
OpenStack oslo.messaging does not verify RabbitMQ broker hostname during TLS handshake
Details

An issue was discovered in OpenStack oslo.messaging 1.0.0 through 17.3.0. The oslo.messaging RabbitMQ driver does not perform TLS hostname verification when connecting to the message broker. When ssl_ca_file is configured, the driver enables certificate chain validation but does not pass the expected broker hostname into the underlying TLS stack. Any certificate signed by the deployment CA is accepted regardless of hostname, allowing an attacker who can intercept control-plane traffic to impersonate the RabbitMQ broker and perform a man-in-the-middle attack on RPC and notification traffic. All OpenStack services using oslo.messaging with RabbitMQ over TLS are affected.

Database specific 
{
    "cwe_ids":  [
        "CWE-295",
        "CWE-297"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-07-15T22:30:07Z",
    "nvd_published_at":  "2026-06-04T16:16:38Z",
    "severity":  "HIGH"
}
References

Affected packages

PyPI / oslo-messaging

Package

Name
oslo-messaging
View open source insights on deps.dev
Purl
pkg:pypi/oslo-messaging

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.0.0
Last Affected
17.3.0

Affected versions

1.*
1.3.0a4
1.3.0a5
1.3.0a6
1.3.0a7
1.3.0a8
1.3.0a9
1.3.0
1.3.1
1.4.0.0a1
1.4.0.0a2
1.4.0.0a3
1.4.0.0a4
1.4.0.0a5
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.6.0
1.7.0
1.8.0
1.8.1
1.8.2
1.8.3
1.9.0
1.10.0
1.11.0
1.12.0
1.12.1
1.13.0
1.14.0
1.15.0
1.16.0
1.17.0
1.17.1
2.*
2.0.0
2.1.0
2.2.0
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.8.0
2.8.1
2.9.0
3.*
3.0.0
3.1.0
4.*
4.0.0
4.1.0
4.2.0
4.3.0
4.4.0
4.5.0
4.5.1
4.6.0
4.6.1
5.*
5.0.0
5.1.0
5.2.0
5.3.0
5.4.0
5.5.0
5.6.0
5.7.0
5.8.0
5.9.0
5.10.0
5.10.1
5.10.2
5.11.0
5.12.0
5.13.0
5.14.0
5.15.0
5.16.0
5.17.0
5.17.1
5.17.2
5.17.3
5.17.4
5.18.0
5.19.0
5.20.0
5.21.0
5.22.0
5.23.0
5.24.0
5.24.1
5.24.2
5.25.0
5.26.0
5.27.0
5.28.0
5.29.0
5.30.0
5.30.1
5.30.2
5.30.3
5.30.4
5.30.5
5.30.6
5.30.7
5.30.8
5.31.0
5.32.0
5.33.0
5.33.1
5.34.0
5.34.1
5.35.0
5.35.1
5.35.2
5.35.3
5.35.4
5.35.5
5.35.6
5.36.0
6.*
6.0.0
6.1.0
6.2.0
6.3.0
6.4.0
6.4.1
6.5.0
7.*
7.0.0
8.*
8.0.0
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
9.*
9.0.0
9.0.1
9.1.0
9.1.1
9.2.0
9.2.1
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.7.1
9.7.2
9.8.0
10.*
10.0.0
10.1.0
10.2.0
10.2.1
10.2.2
10.2.3
10.2.4
10.3.0
10.4.0
10.4.1
10.5.0
11.*
11.0.0
12.*
12.0.0
12.1.0
12.1.1
12.1.2
12.1.3
12.1.4
12.1.5
12.1.6
12.2.0
12.2.1
12.2.2
12.3.0
12.4.0
12.5.0
12.5.1
12.5.2
12.6.0
12.6.1
12.7.0
12.7.1
12.7.2
12.7.3
12.8.0
12.9.0
12.9.1
12.9.2
12.9.3
12.9.4
12.10.0
12.11.0
12.11.1
12.12.0
12.13.0
12.13.1
12.13.2
12.13.3
12.14.0
13.*
13.0.0
14.*
14.0.0
14.0.1
14.0.2
14.0.3
14.1.0
14.2.0
14.2.1
14.2.2
14.2.3
14.2.4
14.2.5
14.3.0
14.3.1
14.4.0
14.4.1
14.4.2
14.5.0
14.6.0
14.7.0
14.7.1
14.7.2
14.7.3
14.8.0
14.8.1
14.9.0
14.9.1
14.9.2
14.9.3
15.*
15.0.0
16.*
16.0.0
16.1.0
16.1.1
16.1.2
17.*
17.0.0
17.1.0
17.2.0
17.3.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-76qh-xr7q-h39m/GHSA-76qh-xr7q-h39m.json"