OpenStack oslo.messaging versions 1.0.0 through 17.3.0 contain a security flaw in the RabbitMQ driver where TLS hostname verification is not performed during connection establishment. Although certificate chain validation is enabled when ssl_ca_file is configured, the expected broker hostname is not passed into the TLS stack, causing any certificate signed by the deployment CA to be accepted regardless of hostname. This enables an attacker capable of intercepting control-plane network traffic to impersonate the RabbitMQ broker and perform man-in-the-middle attacks, potentially compromising the confidentiality and integrity of RPC and notification traffic.

The vulnerability allows an attacker with the ability to intercept control-plane network traffic to impersonate the RabbitMQ message broker. This can lead to man-in-the-middle attacks that compromise the confidentiality and integrity of sensitive RPC and notification data exchanged between OpenStack services using oslo.messaging with RabbitMQ over TLS. There is no impact on availability reported.

No official patch status is explicitly stated in the vendor advisory. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Meanwhile, to mitigate the risk of man-in-the-middle attacks, restrict network access to the RabbitMQ message broker by configuring firewall rules to permit inbound connections to the RabbitMQ port (typically 5672 or 5671 for AMQPS) only from authorized hosts and services within the control plane. This operational measure reduces exposure to attackers attempting to intercept and impersonate the broker.