Description
Amphora Images in OpenStack Octavia >=0.10.0 <2.1.2, >=3.0.0 <3.2.0, >=4.0.0 <4.1.0 allows anyone with access to the management network to bypass client-certificate based authentication and retrieve information or issue configuration commands via simple HTTP requests to the Agent on port https/9443, because the cmd/agent.py gunicorn cert_reqs option is True but is supposed to be ssl.CERT_REQUIRED.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | octavia | 4.0.0-6 | — |
| Debian 13 | octavia | 4.0.0-6 | — |
| Debian 12 | octavia | 4.0.0-6 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 15 | python3-octavia +8 | 4.1.2-0.20200114080449.5a71643.el8ost | RHSA-2020:0721 |
| Red Hat OpenStack 14 | python-octavia +9 | 3.1.0-3.el7ost | RHSA-2019:3743 |
| Red Hat OpenStack 13 | python-octavia +9 | 2.1.2-1.el7ost | RHSA-2019:3788 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE OpenStack Cloud Crowbar 9 | crowbar-core | 6.0+git.1573825081.b1caf60f1-3.16.1 | SUSE-SU-2019:3068-1 |
| SUSE OpenStack Cloud Crowbar 9 | crowbar-openstack | 6.0+git.1573754820.dd036ef77-3.16.1 | SUSE-SU-2019:3068-1 |
| SUSE OpenStack Cloud Crowbar 9 | crowbar-ui | 1.3.0+git.1572871359.50fc6087-14.1 | SUSE-SU-2019:3068-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-barbican | 7.0.1~dev21-3.3.1 | SUSE-SU-2019:3068-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-heat-templates | 0.0.0+git.1553459627.948e8cc-3.3.1 | SUSE-SU-2019:3068-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-keystone | 14.1.1~dev28-3.16.1 | SUSE-SU-2019:3068-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-neutron | 13.0.6~dev8-3.16.2 | SUSE-SU-2019:3068-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-neutron-gbp | 5.0.1~dev476-3.13.1 | SUSE-SU-2019:3068-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-neutron-lbaas | 13.0.1~dev16-3.13.1 | SUSE-SU-2019:3068-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-nova | 18.2.4~dev22-3.16.2 | SUSE-SU-2019:3068-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-octavia | 3.2.1~dev3-3.16.1 | SUSE-SU-2019:3068-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-sahara | 9.0.2~dev14-3.6.1 | SUSE-SU-2019:3068-1 |
| SUSE OpenStack Cloud Crowbar 9 | python-psutil | 5.4.6-3.3.1 | SUSE-SU-2019:3068-1 |
| SUSE OpenStack Cloud Crowbar 9 | release-notes-suse-openstack-cloud | 9.20191025-3.15.1 | SUSE-SU-2019:3068-1 |
| SUSE OpenStack Cloud 9 | ardana-db | 9.0+git.1572311426.a6dc2fd-3.13.1 | SUSE-SU-2019:3068-1 |
| SUSE OpenStack Cloud 9 | ardana-keystone | 9.0+git.1573069087.15ffd1c-3.13.1 | SUSE-SU-2019:3068-1 |
| SUSE OpenStack Cloud 9 | ardana-neutron | 9.0+git.1572019823.6650494-3.16.1 | SUSE-SU-2019:3068-1 |
| SUSE OpenStack Cloud 9 | ardana-nova | 9.0+git.1572618171.4460843-3.13.1 | SUSE-SU-2019:3068-1 |
| SUSE OpenStack Cloud 9 | openstack-barbican | 7.0.1~dev21-3.3.1 | SUSE-SU-2019:3068-1 |
| SUSE OpenStack Cloud 9 | openstack-heat-templates | 0.0.0+git.1553459627.948e8cc-3.3.1 | SUSE-SU-2019:3068-1 |
| SUSE OpenStack Cloud 9 | openstack-keystone | 14.1.1~dev28-3.16.1 | SUSE-SU-2019:3068-1 |
| SUSE OpenStack Cloud 9 | openstack-neutron | 13.0.6~dev8-3.16.2 | SUSE-SU-2019:3068-1 |
| SUSE OpenStack Cloud 9 | openstack-neutron-gbp | 5.0.1~dev476-3.13.1 | SUSE-SU-2019:3068-1 |
| SUSE OpenStack Cloud 9 | openstack-neutron-lbaas | 13.0.1~dev16-3.13.1 | SUSE-SU-2019:3068-1 |
| SUSE OpenStack Cloud 9 | openstack-nova | 18.2.4~dev22-3.16.2 | SUSE-SU-2019:3068-1 |
| SUSE OpenStack Cloud 9 | openstack-octavia | 3.2.1~dev3-3.16.1 | SUSE-SU-2019:3068-1 |
| SUSE OpenStack Cloud 9 | openstack-sahara | 9.0.2~dev14-3.6.1 | SUSE-SU-2019:3068-1 |
| SUSE OpenStack Cloud 9 | python-psutil | 5.4.6-3.3.1 | SUSE-SU-2019:3068-1 |
| SUSE OpenStack Cloud 9 | release-notes-suse-openstack-cloud | 9.20191025-3.15.1 | SUSE-SU-2019:3068-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-barbican | 7.0.1~dev21-3.13.1 | SUSE-SU-2019:3068-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-cinder | 13.0.8~dev8-3.13.1 | SUSE-SU-2019:3068-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-designate | 7.0.1~dev22-3.13.1 | SUSE-SU-2019:3068-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-heat | 11.0.3~dev23-3.13.1 | SUSE-SU-2019:3068-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-keystone | 14.1.1~dev28-3.13.1 | SUSE-SU-2019:3068-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-magnum | 7.1.1~dev28-4.13.1 | SUSE-SU-2019:3068-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-manila | 7.3.1~dev15-3.13.1 | SUSE-SU-2019:3068-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-monasca-ceilometer | 1.8.2~dev3-3.13.1 | SUSE-SU-2019:3068-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-neutron | 13.0.6~dev8-6.13.1 | SUSE-SU-2019:3068-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-nova | 18.2.4~dev22-3.13.1 | SUSE-SU-2019:3068-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-octavia | 3.2.1~dev3-4.13.1 | SUSE-SU-2019:3068-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-sahara | 9.0.2~dev14-3.13.1 | SUSE-SU-2019:3068-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | octavia | >= 0.10.0, < 2.1.2 | 2.1.2 | GHSA-r4v4-3jj7-jc29 |
| PyPI | octavia | >= 3.0.0, < 3.2.0 | 3.2.0 | GHSA-r4v4-3jj7-jc29 |
| PyPI | octavia | >= 4.0.0, < 4.1.0 | 4.1.0 | GHSA-r4v4-3jj7-jc29 |
| PyPI | octavia | >= 0.10.0, < 2.1.2 · >= 3.0.0, < 3.2.0 · >= 4.0.0, < 4.1.0 | 2.1.2, 3.2.0, 4.1.0 | PYSEC-2026-433 |
Advisories 4
- RHSA-2020:0721 Red Hat Security Advisory: openstack-octavia security update Red Hat Security Advisories (RHSA) · Aug 8, 2026
- RHSA-2019:3743 Red Hat Security Advisory: openstack-octavia security update Red Hat Security Advisories (RHSA) · Aug 8, 2026
- RHSA-2019:3788 Red Hat Security Advisory: openstack-octavia security and bug fix update Red Hat Security Advisories (RHSA) · Aug 8, 2026
- SUSE-SU-2019:3068-1 Security update for ardana-db, ardana-keystone, ardana-neutron, ardana-nova, crowbar-core, crowbar-openstack, crowbar-ui, openstack-barbican, openstack-heat-templates, openstack-keystone, openstack-neutron, openstack-neutron-gbp, openstack-neutron-lbaas, openstack-nova, openstack-octavia, openstack-sahara, python-psutil, release-notes-suse-openstack-cloud SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://storyboard.openstack.org/#%21/story/2006660
- https://review.opendev.org/686547
- https://review.opendev.org/686546
- https://review.opendev.org/686545
- https://review.opendev.org/686544
- https://review.opendev.org/686543
- https://review.opendev.org/686541
- https://security.openstack.org/ossa/OSSA-2019-005.html
- USN-4153-1 vendor-advisory
- RHSA-2019:3743 vendor-advisory
- RHSA-2019:3788 vendor-advisory
- RHSA-2020:0721 vendor-advisory